fix(celery): Guardrail for User File Processing (#8633)

This reverts commit f945ab6b05.

.github/pull_request_template.md

@@ -8,5 +8,4 @@
 
 ## Additional Options
 
-- [ ] [Required] I have considered whether this PR needs to be cherry-picked to the latest beta branch.
 - [ ] [Optional] Override Linear Check

.github/workflows/deployment.yml

@@ -26,14 +26,12 @@ jobs:
       build-web: ${{ steps.check.outputs.build-web }}
       build-web-cloud: ${{ steps.check.outputs.build-web-cloud }}
       build-backend: ${{ steps.check.outputs.build-backend }}
-      build-backend-craft: ${{ steps.check.outputs.build-backend-craft }}
       build-model-server: ${{ steps.check.outputs.build-model-server }}
       is-cloud-tag: ${{ steps.check.outputs.is-cloud-tag }}
       is-stable: ${{ steps.check.outputs.is-stable }}
       is-beta: ${{ steps.check.outputs.is-beta }}
       is-stable-standalone: ${{ steps.check.outputs.is-stable-standalone }}
       is-beta-standalone: ${{ steps.check.outputs.is-beta-standalone }}
-      is-craft-latest: ${{ steps.check.outputs.is-craft-latest }}
       is-test-run: ${{ steps.check.outputs.is-test-run }}
       sanitized-tag: ${{ steps.check.outputs.sanitized-tag }}
       short-sha: ${{ steps.check.outputs.short-sha }}
@@ -56,20 +54,15 @@ jobs:
           IS_BETA=false
           IS_STABLE_STANDALONE=false
           IS_BETA_STANDALONE=false
-          IS_CRAFT_LATEST=false
           IS_PROD_TAG=false
           IS_TEST_RUN=false
           BUILD_DESKTOP=false
           BUILD_WEB=false
           BUILD_WEB_CLOUD=false
           BUILD_BACKEND=true
-          BUILD_BACKEND_CRAFT=false
           BUILD_MODEL_SERVER=true
 
           # Determine tag type based on pattern matching (do regex checks once)
-          if [[ "$TAG" == craft-* ]]; then
-            IS_CRAFT_LATEST=true
-          fi
           if [[ "$TAG" == *cloud* ]]; then
             IS_CLOUD=true
           fi
@@ -97,12 +90,6 @@ jobs:
             fi
           fi
 
-          # Craft-latest builds backend with Craft enabled
-          if [[ "$IS_CRAFT_LATEST" == "true" ]]; then
-            BUILD_BACKEND_CRAFT=true
-            BUILD_BACKEND=false
-          fi
-
           # Standalone version checks (for backend/model-server - version excluding cloud tags)
           if [[ "$IS_STABLE" == "true" ]] && [[ "$IS_CLOUD" != "true" ]]; then
             IS_STABLE_STANDALONE=true
@@ -126,14 +113,12 @@ jobs:
             echo "build-web=$BUILD_WEB"
             echo "build-web-cloud=$BUILD_WEB_CLOUD"
             echo "build-backend=$BUILD_BACKEND"
-            echo "build-backend-craft=$BUILD_BACKEND_CRAFT"
             echo "build-model-server=$BUILD_MODEL_SERVER"
             echo "is-cloud-tag=$IS_CLOUD"
             echo "is-stable=$IS_STABLE"
             echo "is-beta=$IS_BETA"
             echo "is-stable-standalone=$IS_STABLE_STANDALONE"
             echo "is-beta-standalone=$IS_BETA_STANDALONE"
-            echo "is-craft-latest=$IS_CRAFT_LATEST"
             echo "is-test-run=$IS_TEST_RUN"
             echo "sanitized-tag=$SANITIZED_TAG"
             echo "short-sha=$SHORT_SHA"
@@ -145,13 +130,13 @@ jobs:
     if: ${{ !startsWith(github.ref_name, 'nightly-latest') && github.event_name != 'workflow_dispatch' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
           fetch-depth: 0
 
       - name: Setup uv
-        uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # ratchet:astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@ed21f2f24f8dd64503750218de024bcf64c7250a # ratchet:astral-sh/setup-uv@v7
         with:
           version: "0.9.9"
           # NOTE: This isn't caching much and zizmor suggests this could be poisoned, so disable.
@@ -170,7 +155,7 @@ jobs:
     environment: release
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -219,7 +204,7 @@ jobs:
     timeout-minutes: 90
     environment: release
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6.0.1
         with:
           # NOTE: persist-credentials is needed for tauri-action to create GitHub releases.
           persist-credentials: true # zizmor: ignore[artipacked]
@@ -392,7 +377,7 @@ jobs:
       - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -419,7 +404,7 @@ jobs:
             latest=false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
         uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # ratchet:docker/login-action@v3
@@ -465,7 +450,7 @@ jobs:
       - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -492,7 +477,7 @@ jobs:
             latest=false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
         uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # ratchet:docker/login-action@v3
@@ -552,7 +537,7 @@ jobs:
           parse-json-secrets: true
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
         uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # ratchet:docker/login-action@v3
@@ -603,7 +588,7 @@ jobs:
       - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -630,7 +615,7 @@ jobs:
             latest=false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
         uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # ratchet:docker/login-action@v3
@@ -684,7 +669,7 @@ jobs:
       - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -711,7 +696,7 @@ jobs:
             latest=false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
         uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # ratchet:docker/login-action@v3
@@ -779,7 +764,7 @@ jobs:
           parse-json-secrets: true
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
         uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # ratchet:docker/login-action@v3
@@ -827,7 +812,7 @@ jobs:
       - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
 
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -854,7 +839,7 @@ jobs:
             latest=false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
         uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # ratchet:docker/login-action@v3
@@ -899,7 +884,7 @@ jobs:
       - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
 
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -926,7 +911,7 @@ jobs:
             latest=false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
         uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # ratchet:docker/login-action@v3
@@ -985,7 +970,7 @@ jobs:
           parse-json-secrets: true
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
         uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # ratchet:docker/login-action@v3
@@ -1018,217 +1003,6 @@ jobs:
             $(printf '%s\n' "${META_TAGS}" | xargs -I {} echo -t {}) \
             $IMAGES
 
-  build-backend-craft-amd64:
-    needs: determine-builds
-    if: needs.determine-builds.outputs.build-backend-craft == 'true'
-    runs-on:
-      - runs-on
-      - runner=2cpu-linux-x64
-      - run-id=${{ github.run_id }}-backend-craft-amd64
-      - extras=ecr-cache
-    timeout-minutes: 90
-    environment: release
-    outputs:
-      digest: ${{ steps.build.outputs.digest }}
-    env:
-      REGISTRY_IMAGE: onyxdotapp/onyx-backend
-    steps:
-      - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
-
-      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
-        with:
-          persist-credentials: false
-
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708
-        with:
-          role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
-          aws-region: us-east-2
-
-      - name: Get AWS Secrets
-        uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802
-        with:
-          secret-ids: |
-            DOCKER_USERNAME, deploy/docker-username
-            DOCKER_TOKEN, deploy/docker-token
-          parse-json-secrets: true
-
-      - name: Docker meta
-        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # ratchet:docker/metadata-action@v5
-        with:
-          images: ${{ env.REGISTRY_IMAGE }}
-          flavor: |
-            latest=false
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # ratchet:docker/login-action@v3
-        with:
-          username: ${{ env.DOCKER_USERNAME }}
-          password: ${{ env.DOCKER_TOKEN }}
-
-      - name: Build and push AMD64
-        id: build
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # ratchet:docker/build-push-action@v6
-        with:
-          context: ./backend
-          file: ./backend/Dockerfile
-          platforms: linux/amd64
-          labels: ${{ steps.meta.outputs.labels }}
-          build-args: |
-            ONYX_VERSION=${{ github.ref_name }}
-            ENABLE_CRAFT=true
-          cache-from: |
-            type=registry,ref=${{ env.REGISTRY_IMAGE }}:latest
-            type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:backend-craft-cache-amd64
-          cache-to: |
-            type=inline
-            type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:backend-craft-cache-amd64,mode=max
-          outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true
-          no-cache: ${{ vars.DOCKER_NO_CACHE == 'true' }}
-
-  build-backend-craft-arm64:
-    needs: determine-builds
-    if: needs.determine-builds.outputs.build-backend-craft == 'true'
-    runs-on:
-      - runs-on
-      - runner=2cpu-linux-arm64
-      - run-id=${{ github.run_id }}-backend-craft-arm64
-      - extras=ecr-cache
-    timeout-minutes: 90
-    environment: release
-    outputs:
-      digest: ${{ steps.build.outputs.digest }}
-    env:
-      REGISTRY_IMAGE: onyxdotapp/onyx-backend
-    steps:
-      - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
-
-      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
-        with:
-          persist-credentials: false
-
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708
-        with:
-          role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
-          aws-region: us-east-2
-
-      - name: Get AWS Secrets
-        uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802
-        with:
-          secret-ids: |
-            DOCKER_USERNAME, deploy/docker-username
-            DOCKER_TOKEN, deploy/docker-token
-          parse-json-secrets: true
-
-      - name: Docker meta
-        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # ratchet:docker/metadata-action@v5
-        with:
-          images: ${{ env.REGISTRY_IMAGE }}
-          flavor: |
-            latest=false
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # ratchet:docker/login-action@v3
-        with:
-          username: ${{ env.DOCKER_USERNAME }}
-          password: ${{ env.DOCKER_TOKEN }}
-
-      - name: Build and push ARM64
-        id: build
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # ratchet:docker/build-push-action@v6
-        with:
-          context: ./backend
-          file: ./backend/Dockerfile
-          platforms: linux/arm64
-          labels: ${{ steps.meta.outputs.labels }}
-          build-args: |
-            ONYX_VERSION=${{ github.ref_name }}
-            ENABLE_CRAFT=true
-          cache-from: |
-            type=registry,ref=${{ env.REGISTRY_IMAGE }}:latest
-            type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:backend-craft-cache-arm64
-          cache-to: |
-            type=inline
-            type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:backend-craft-cache-arm64,mode=max
-          outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true
-          no-cache: ${{ vars.DOCKER_NO_CACHE == 'true' }}
-
-  merge-backend-craft:
-    needs:
-      - determine-builds
-      - build-backend-craft-amd64
-      - build-backend-craft-arm64
-    if: needs.determine-builds.outputs.build-backend-craft == 'true'
-    runs-on:
-      - runs-on
-      - runner=2cpu-linux-x64
-      - run-id=${{ github.run_id }}-merge-backend-craft
-      - extras=ecr-cache
-    timeout-minutes: 90
-    environment: release
-    env:
-      REGISTRY_IMAGE: onyxdotapp/onyx-backend
-    steps:
-      - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
-
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708
-        with:
-          role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
-          aws-region: us-east-2
-
-      - name: Get AWS Secrets
-        uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802
-        with:
-          secret-ids: |
-            DOCKER_USERNAME, deploy/docker-username
-            DOCKER_TOKEN, deploy/docker-token
-          parse-json-secrets: true
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # ratchet:docker/login-action@v3
-        with:
-          username: ${{ env.DOCKER_USERNAME }}
-          password: ${{ env.DOCKER_TOKEN }}
-
-      - name: Docker meta
-        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # ratchet:docker/metadata-action@v5
-        with:
-          images: ${{ env.REGISTRY_IMAGE }}
-          flavor: |
-            latest=false
-          tags: |
-            type=raw,value=craft-latest
-            # TODO: Consider aligning craft-latest tags with regular backend builds (e.g., latest, edge, beta)
-            # to keep tagging strategy consistent across all backend images
-
-      - name: Create and push manifest
-        env:
-          IMAGE_REPO: ${{ env.REGISTRY_IMAGE }}
-          AMD64_DIGEST: ${{ needs.build-backend-craft-amd64.outputs.digest }}
-          ARM64_DIGEST: ${{ needs.build-backend-craft-arm64.outputs.digest }}
-          META_TAGS: ${{ steps.meta.outputs.tags }}
-        run: |
-          IMAGES="${IMAGE_REPO}@${AMD64_DIGEST} ${IMAGE_REPO}@${ARM64_DIGEST}"
-          docker buildx imagetools create \
-            $(printf '%s\n' "${META_TAGS}" | xargs -I {} echo -t {}) \
-            $IMAGES
-
   build-model-server-amd64:
     needs: determine-builds
     if: needs.determine-builds.outputs.build-model-server == 'true'
@@ -1248,7 +1022,7 @@ jobs:
       - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
 
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -1275,7 +1049,7 @@ jobs:
             latest=false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3
         with:
           buildkitd-flags: ${{ vars.DOCKER_DEBUG == 'true' && '--debug' || '' }}
 
@@ -1327,7 +1101,7 @@ jobs:
       - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
 
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -1354,7 +1128,7 @@ jobs:
             latest=false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3
         with:
           buildkitd-flags: ${{ vars.DOCKER_DEBUG == 'true' && '--debug' || '' }}
 
@@ -1419,7 +1193,7 @@ jobs:
           parse-json-secrets: true
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
         uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # ratchet:docker/login-action@v3
@@ -1580,7 +1354,7 @@ jobs:
       - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -1692,20 +1466,17 @@ jobs:
       - build-backend-amd64
       - build-backend-arm64
       - merge-backend
-      - build-backend-craft-amd64
-      - build-backend-craft-arm64
-      - merge-backend-craft
       - build-model-server-amd64
       - build-model-server-arm64
       - merge-model-server
-    if: always() && (needs.build-desktop.result == 'failure' || needs.build-web-amd64.result == 'failure' || needs.build-web-arm64.result == 'failure' || needs.merge-web.result == 'failure' || needs.build-web-cloud-amd64.result == 'failure' || needs.build-web-cloud-arm64.result == 'failure' || needs.merge-web-cloud.result == 'failure' || needs.build-backend-amd64.result == 'failure' || needs.build-backend-arm64.result == 'failure' || needs.merge-backend.result == 'failure' || (needs.determine-builds.outputs.build-backend-craft == 'true' && (needs.build-backend-craft-amd64.result == 'failure' || needs.build-backend-craft-arm64.result == 'failure' || needs.merge-backend-craft.result == 'failure')) || needs.build-model-server-amd64.result == 'failure' || needs.build-model-server-arm64.result == 'failure' || needs.merge-model-server.result == 'failure') && needs.determine-builds.outputs.is-test-run != 'true'
+    if: always() && (needs.build-desktop.result == 'failure' || needs.build-web-amd64.result == 'failure' || needs.build-web-arm64.result == 'failure' || needs.merge-web.result == 'failure' || needs.build-web-cloud-amd64.result == 'failure' || needs.build-web-cloud-arm64.result == 'failure' || needs.merge-web-cloud.result == 'failure' || needs.build-backend-amd64.result == 'failure' || needs.build-backend-arm64.result == 'failure' || needs.merge-backend.result == 'failure' || needs.build-model-server-amd64.result == 'failure' || needs.build-model-server-arm64.result == 'failure' || needs.merge-model-server.result == 'failure') && needs.determine-builds.outputs.is-test-run != 'true'
     # NOTE: Github-hosted runners have about 20s faster queue times and are preferred here.
     runs-on: ubuntu-slim
     timeout-minutes: 90
     environment: release
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 

.github/workflows/docker-tag-beta.yml

@@ -21,7 +21,7 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
         uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # ratchet:docker/login-action@v3

.github/workflows/docker-tag-latest.yml

@@ -21,7 +21,7 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
         uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # ratchet:docker/login-action@v3

.github/workflows/helm-chart-releases.yml

@@ -15,7 +15,7 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -29,7 +29,6 @@ jobs:
         run: |
           helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
           helm repo add onyx-vespa https://onyx-dot-app.github.io/vespa-helm-charts
-          helm repo add opensearch https://opensearch-project.github.io/helm-charts
           helm repo add cloudnative-pg https://cloudnative-pg.github.io/charts
           helm repo add ot-container-kit https://ot-container-kit.github.io/helm-charts
           helm repo add minio https://charts.min.io/

.github/workflows/nightly-scan-licenses.yml

@@ -28,7 +28,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -94,7 +94,7 @@ jobs:
 
     steps:
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
+      uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3
 
     - name: Login to Docker Hub
       uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # ratchet:docker/login-action@v3

.github/workflows/pr-beta-cherrypick-check.yml

@@ -1,28 +0,0 @@
-name: Require beta cherry-pick consideration
-concurrency:
-  group: Require-Beta-Cherrypick-Consideration-${{ github.workflow }}-${{ github.head_ref || github.event.workflow_run.head_branch || github.run_id }}
-  cancel-in-progress: true
-
-on:
-  pull_request:
-    types: [opened, edited, reopened, synchronize]
-
-permissions:
-  contents: read
-
-jobs:
-  beta-cherrypick-check:
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-    steps:
-      - name: Check PR body for beta cherry-pick consideration
-        env:
-          PR_BODY: ${{ github.event.pull_request.body }}
-        run: |
-          if echo "$PR_BODY" | grep -qiE "\\[x\\][[:space:]]*\\[Required\\][[:space:]]*I have considered whether this PR needs to be cherry[- ]picked to the latest beta branch"; then
-            echo "Cherry-pick consideration box is checked. Check passed."
-            exit 0
-          fi
-
-          echo "::error::Please check the 'I have considered whether this PR needs to be cherry-picked to the latest beta branch' box in the PR description."
-          exit 1

.github/workflows/pr-database-tests.yml

@@ -27,7 +27,7 @@ jobs:
       - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
 
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 

.github/workflows/pr-desktop-build.yml

@@ -1,114 +0,0 @@
-name: Build Desktop App
-concurrency:
-  group: Build-Desktop-App-${{ github.workflow }}-${{ github.head_ref || github.event.workflow_run.head_branch || github.run_id }}
-  cancel-in-progress: true
-
-on:
-  merge_group:
-  pull_request:
-    branches:
-      - main
-      - "release/**"
-    paths:
-      - "desktop/**"
-      - ".github/workflows/pr-desktop-build.yml"
-  push:
-    tags:
-      - "v*.*.*"
-
-permissions:
-  contents: read
-
-jobs:
-  build-desktop:
-    name: Build Desktop (${{ matrix.platform }})
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 60
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - platform: linux
-            os: ubuntu-latest
-            target: x86_64-unknown-linux-gnu
-            args: "--bundles deb,rpm"
-          # TODO: Fix and enable the macOS build.
-          #- platform: macos
-          #  os: macos-latest
-          #  target: universal-apple-darwin
-          #  args: "--target universal-apple-darwin"
-          # TODO: Fix and enable the Windows build.
-          #- platform: windows
-          #  os: windows-latest
-          #  target: x86_64-pc-windows-msvc
-          #  args: ""
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
-        with:
-          persist-credentials: false
-
-      - name: Setup node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
-        with:
-          node-version: 24
-          cache: "npm" # zizmor: ignore[cache-poisoning]
-          cache-dependency-path: ./desktop/package-lock.json
-
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7
-        with:
-          toolchain: stable
-          targets: ${{ matrix.target }}
-
-      - name: Cache Cargo registry and build
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # zizmor: ignore[cache-poisoning]
-        with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-            ~/.cargo/git/db/
-            desktop/src-tauri/target/
-          key: ${{ runner.os }}-cargo-${{ hashFiles('desktop/src-tauri/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-
-
-      - name: Install Linux dependencies
-        if: matrix.platform == 'linux'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y \
-            build-essential \
-            libglib2.0-dev \
-            libgirepository1.0-dev \
-            libgtk-3-dev \
-            libjavascriptcoregtk-4.1-dev \
-            libwebkit2gtk-4.1-dev \
-            libayatana-appindicator3-dev \
-            gobject-introspection \
-            pkg-config \
-            curl \
-            xdg-utils
-
-      - name: Install npm dependencies
-        working-directory: ./desktop
-        run: npm ci
-
-      - name: Build desktop app
-        working-directory: ./desktop
-        run: npx tauri build ${{ matrix.args }}
-        env:
-          TAURI_SIGNING_PRIVATE_KEY: ""
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ""
-
-      - name: Upload build artifacts
-        if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
-        with:
-          name: desktop-build-${{ matrix.platform }}-${{ github.run_id }}
-          path: |
-            desktop/src-tauri/target/release/bundle/
-          retention-days: 7
-          if-no-files-found: ignore

.github/workflows/pr-external-dependency-unit-tests.yml

@@ -45,9 +45,6 @@ env:
   # TODO: debug why this is failing and enable
   CODE_INTERPRETER_BASE_URL: http://localhost:8000
 
-  # OpenSearch
-  OPENSEARCH_ADMIN_PASSWORD: "StrongPassword123!"
-
 jobs:
   discover-test-dirs:
     # NOTE: Github-hosted runners have about 20s faster queue times and are preferred here.
@@ -57,7 +54,7 @@ jobs:
       test-dirs: ${{ steps.set-matrix.outputs.test-dirs }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -91,7 +88,7 @@ jobs:
       - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
 
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -128,13 +125,11 @@ jobs:
           docker compose \
             -f docker-compose.yml \
             -f docker-compose.dev.yml \
-            -f docker-compose.opensearch.yml \
             up -d \
             minio \
             relational_db \
             cache \
             index \
-            opensearch \
             code-interpreter
 
       - name: Run migrations
@@ -163,7 +158,7 @@ jobs:
           cd deployment/docker_compose
 
           # Get list of running containers
-          containers=$(docker compose -f docker-compose.yml -f docker-compose.dev.yml -f docker-compose.opensearch.yml ps -q)
+          containers=$(docker compose -f docker-compose.yml -f docker-compose.dev.yml ps -q)
 
           # Collect logs from each container
           for container in $containers; do

.github/workflows/pr-helm-chart-testing.yml

@@ -30,7 +30,7 @@ jobs:
     # fetch-depth 0 is required for helm/chart-testing-action
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -88,7 +88,6 @@ jobs:
           echo "=== Adding Helm repositories ==="
           helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
           helm repo add vespa https://onyx-dot-app.github.io/vespa-helm-charts
-          helm repo add opensearch https://opensearch-project.github.io/helm-charts
           helm repo add cloudnative-pg https://cloudnative-pg.github.io/charts
           helm repo add ot-container-kit https://ot-container-kit.github.io/helm-charts
           helm repo add minio https://charts.min.io/
@@ -181,11 +180,6 @@ jobs:
           trap cleanup EXIT
 
           # Run the actual installation with detailed logging
-          # Note that opensearch.enabled is true whereas others in this install
-          # are false. There is some work that needs to be done to get this
-          # entire step working in CI, enabling opensearch here is a small step
-          # in that direction. If this is causing issues, disabling it in this
-          # step should be ok in the short term.
           echo "=== Starting ct install ==="
           set +e
           ct install --all \
@@ -193,10 +187,9 @@ jobs:
               --set=nginx.enabled=false \
               --set=minio.enabled=false \
               --set=vespa.enabled=false \
-              --set=opensearch.enabled=true \
-              --set=auth.opensearch.enabled=true \
               --set=slackbot.enabled=false \
               --set=postgresql.enabled=true \
+              --set=postgresql.nameOverride=cloudnative-pg \
               --set=postgresql.cluster.storage.storageClass=standard \
               --set=redis.enabled=true \
               --set=redis.storageSpec.volumeClaimTemplate.spec.storageClassName=standard \

.github/workflows/pr-integration-tests.yml

@@ -48,7 +48,7 @@ jobs:
       test-dirs: ${{ steps.set-matrix.outputs.test-dirs }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -84,7 +84,7 @@ jobs:
     steps:
       - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -103,7 +103,7 @@ jobs:
           echo "cache-suffix=${CACHE_SUFFIX}" >> $GITHUB_OUTPUT
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3
 
       # needed for pulling Vespa, Redis, Postgres, and Minio images
       # otherwise, we hit the "Unauthenticated users" limit
@@ -144,7 +144,7 @@ jobs:
     steps:
       - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -163,7 +163,7 @@ jobs:
           echo "cache-suffix=${CACHE_SUFFIX}" >> $GITHUB_OUTPUT
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3
 
       # needed for pulling Vespa, Redis, Postgres, and Minio images
       # otherwise, we hit the "Unauthenticated users" limit
@@ -203,12 +203,12 @@ jobs:
     steps:
       - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3
 
       # needed for pulling openapitools/openapi-generator-cli
       # otherwise, we hit the "Unauthenticated users" limit
@@ -279,7 +279,7 @@ jobs:
     steps:
       - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -460,7 +460,7 @@ jobs:
     steps:
       - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 

.github/workflows/pr-jest-tests.yml

@@ -23,7 +23,7 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 

.github/workflows/pr-mit-integration-tests.yml

@@ -40,7 +40,7 @@ jobs:
       test-dirs: ${{ steps.set-matrix.outputs.test-dirs }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -76,7 +76,7 @@ jobs:
     steps:
       - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -95,7 +95,7 @@ jobs:
           echo "cache-suffix=${CACHE_SUFFIX}" >> $GITHUB_OUTPUT
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3
 
       # needed for pulling Vespa, Redis, Postgres, and Minio images
       # otherwise, we hit the "Unauthenticated users" limit
@@ -136,7 +136,7 @@ jobs:
     steps:
       - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -155,7 +155,7 @@ jobs:
           echo "cache-suffix=${CACHE_SUFFIX}" >> $GITHUB_OUTPUT
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3
 
       # needed for pulling Vespa, Redis, Postgres, and Minio images
       # otherwise, we hit the "Unauthenticated users" limit
@@ -195,7 +195,7 @@ jobs:
     steps:
       - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -214,7 +214,7 @@ jobs:
           echo "cache-suffix=${CACHE_SUFFIX}" >> $GITHUB_OUTPUT
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3
 
       # needed for pulling openapitools/openapi-generator-cli
       # otherwise, we hit the "Unauthenticated users" limit
@@ -271,7 +271,7 @@ jobs:
     steps:
       - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 

.github/workflows/pr-playwright-tests.yml

@@ -66,7 +66,7 @@ jobs:
       - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
 
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -85,7 +85,7 @@ jobs:
           echo "cache-suffix=${CACHE_SUFFIX}" >> $GITHUB_OUTPUT
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3
 
       # needed for pulling external images otherwise, we hit the "Unauthenticated users" limit
       # https://docs.docker.com/docker-hub/usage/
@@ -127,7 +127,7 @@ jobs:
       - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
 
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -146,7 +146,7 @@ jobs:
           echo "cache-suffix=${CACHE_SUFFIX}" >> $GITHUB_OUTPUT
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3
 
       # needed for pulling external images otherwise, we hit the "Unauthenticated users" limit
       # https://docs.docker.com/docker-hub/usage/
@@ -188,7 +188,7 @@ jobs:
       - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
 
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -207,7 +207,7 @@ jobs:
           echo "cache-suffix=${CACHE_SUFFIX}" >> $GITHUB_OUTPUT
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # ratchet:docker/setup-buildx-action@v3
 
       # needed for pulling external images otherwise, we hit the "Unauthenticated users" limit
       # https://docs.docker.com/docker-hub/usage/
@@ -254,7 +254,7 @@ jobs:
       - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
 
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -488,7 +488,7 @@ jobs:
 #     ]
 #   steps:
 #     - name: Checkout code
-#       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+#       uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
 #       with:
 #         fetch-depth: 0
 

.github/workflows/pr-python-checks.yml

@@ -27,7 +27,7 @@ jobs:
     steps:
       - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 

.github/workflows/pr-python-connector-tests.yml

@@ -65,7 +65,7 @@ env:
   ZENDESK_TOKEN: ${{ secrets.ZENDESK_TOKEN }}
 
   # Salesforce
-  SF_USERNAME: ${{ vars.SF_USERNAME }}
+  SF_USERNAME: ${{ secrets.SF_USERNAME }}
   SF_PASSWORD: ${{ secrets.SF_PASSWORD }}
   SF_SECURITY_TOKEN: ${{ secrets.SF_SECURITY_TOKEN }}
 
@@ -110,9 +110,6 @@ env:
   # Slack
   SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
 
-  # Discord
-  DISCORD_CONNECTOR_BOT_TOKEN: ${{ secrets.DISCORD_CONNECTOR_BOT_TOKEN }}
-
   # Teams
   TEAMS_APPLICATION_ID: ${{ secrets.TEAMS_APPLICATION_ID }}
   TEAMS_DIRECTORY_ID: ${{ secrets.TEAMS_DIRECTORY_ID }}
@@ -142,7 +139,7 @@ jobs:
       - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
 
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 

.github/workflows/pr-python-model-tests.yml

@@ -5,6 +5,11 @@ on:
     # This cron expression runs the job daily at 16:00 UTC (9am PT)
     - cron: "0 16 * * *"
   workflow_dispatch:
+    inputs:
+      branch:
+        description: 'Branch to run the workflow on'
+        required: false
+        default: 'main'
 
 permissions:
   contents: read
@@ -26,11 +31,7 @@ env:
 jobs:
   model-check:
     # See https://runs-on.com/runners/linux/
-    runs-on:
-      - runs-on
-      - runner=4cpu-linux-arm64
-      - "run-id=${{ github.run_id }}-model-check"
-      - "extras=ecr-cache"
+    runs-on: [runs-on,runner=8cpu-linux-x64,"run-id=${{ github.run_id }}-model-check"]
     timeout-minutes: 45
 
     env:
@@ -38,87 +39,108 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
 
-      - name: Setup Python and Install Dependencies
-        uses: ./.github/actions/setup-python-and-install-dependencies
-        with:
-          requirements: |
-            backend/requirements/default.txt
-            backend/requirements/dev.txt
-
-      - name: Format branch name for cache
-        id: format-branch
-        env:
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          REF_NAME: ${{ github.ref_name }}
-        run: |
-          if [ -n "${PR_NUMBER}" ]; then
-            CACHE_SUFFIX="${PR_NUMBER}"
-          else
-            # shellcheck disable=SC2001
-            CACHE_SUFFIX=$(echo "${REF_NAME}" | sed 's/[^A-Za-z0-9._-]/-/g')
-          fi
-          echo "cache-suffix=${CACHE_SUFFIX}" >> $GITHUB_OUTPUT
-
       - name: Login to Docker Hub
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # ratchet:docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_TOKEN }}
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
+      # tag every docker image with "test" so that we can spin up the correct set
+      # of images during testing
 
-      - name: Build and load
-        uses: docker/bake-action@5be5f02ff8819ecd3092ea6b2e6261c31774f2b4 # ratchet:docker/bake-action@v6
-        env:
-          TAG: model-server-${{ github.run_id }}
+      # We don't need to build the Web Docker image since it's not yet used
+      # in the integration tests. We have a separate action to verify that it builds
+      # successfully.
+      - name: Pull Model Server Docker image
+        run: |
+          docker pull onyxdotapp/onyx-model-server:latest
+          docker tag onyxdotapp/onyx-model-server:latest onyxdotapp/onyx-model-server:test
+
+      - name: Set up Python
+        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # ratchet:actions/setup-python@v6
         with:
-          load: true
-          targets: model-server
-          set: |
-            model-server.cache-from=type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:model-server-cache-${{ github.event.pull_request.head.sha || github.sha }}
-            model-server.cache-from=type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:model-server-cache-${{ steps.format-branch.outputs.cache-suffix }}
-            model-server.cache-from=type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:model-server-cache
-            model-server.cache-from=type=registry,ref=onyxdotapp/onyx-model-server:latest
-            model-server.cache-to=type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:model-server-cache-${{ github.event.pull_request.head.sha || github.sha }},mode=max
-            model-server.cache-to=type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:model-server-cache-${{ steps.format-branch.outputs.cache-suffix }},mode=max
-            model-server.cache-to=type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:model-server-cache,mode=max
+          python-version: "3.11"
+          cache: "pip"
+          cache-dependency-path: |
+            backend/requirements/default.txt
+            backend/requirements/dev.txt
+
+      - name: Install Dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install --retries 5 --timeout 30 -r backend/requirements/default.txt
+          pip install --retries 5 --timeout 30 -r backend/requirements/dev.txt
 
       - name: Start Docker containers
-        id: start_docker
-        env:
-          IMAGE_TAG: model-server-${{ github.run_id }}
         run: |
           cd deployment/docker_compose
-          docker compose \
-            -f docker-compose.yml \
-            -f docker-compose.dev.yml \
-            up -d --wait \
-            inference_model_server
+          ENABLE_PAID_ENTERPRISE_EDITION_FEATURES=true \
+          AUTH_TYPE=basic \
+          REQUIRE_EMAIL_VERIFICATION=false \
+          DISABLE_TELEMETRY=true \
+          IMAGE_TAG=test \
+          docker compose -f docker-compose.model-server-test.yml up -d indexing_model_server
+        id: start_docker
+
+      - name: Wait for service to be ready
+        run: |
+          echo "Starting wait-for-service script..."
+
+          start_time=$(date +%s)
+          timeout=300  # 5 minutes in seconds
+
+          while true; do
+            current_time=$(date +%s)
+            elapsed_time=$((current_time - start_time))
+
+            if [ $elapsed_time -ge $timeout ]; then
+              echo "Timeout reached. Service did not become ready in 5 minutes."
+              exit 1
+            fi
+
+            # Use curl with error handling to ignore specific exit code 56
+            response=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:9000/api/health || echo "curl_error")
+
+            if [ "$response" = "200" ]; then
+              echo "Service is ready!"
+              break
+            elif [ "$response" = "curl_error" ]; then
+              echo "Curl encountered an error, possibly exit code 56. Continuing to retry..."
+            else
+              echo "Service not ready yet (HTTP status $response). Retrying in 5 seconds..."
+            fi
+
+            sleep 5
+          done
+          echo "Finished waiting for service."
 
       - name: Run Tests
+        shell: script -q -e -c "bash --noprofile --norc -eo pipefail {0}"
         run: |
           py.test -o junit_family=xunit2 -xv --ff backend/tests/daily/llm
           py.test -o junit_family=xunit2 -xv --ff backend/tests/daily/embedding
 
       - name: Alert on Failure
         if: failure() && github.event_name == 'schedule'
-        uses: ./.github/actions/slack-notify
-        with:
-          webhook-url: ${{ secrets.SLACK_WEBHOOK }}
-          failed-jobs: model-check
-          title: "🚨 Scheduled Model Tests failed!"
-          ref-name: ${{ github.ref_name }}
+        env:
+          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
+          REPO: ${{ github.repository }}
+          RUN_ID: ${{ github.run_id }}
+        run: |
+          curl -X POST \
+            -H 'Content-type: application/json' \
+            --data "{\"text\":\"Scheduled Model Tests failed! Check the run at: https://github.com/${REPO}/actions/runs/${RUN_ID}\"}" \
+            $SLACK_WEBHOOK
 
       - name: Dump all-container logs (optional)
         if: always()
         run: |
           cd deployment/docker_compose
-          docker compose logs --no-color > $GITHUB_WORKSPACE/docker-compose.log || true
+          docker compose -f docker-compose.model-server-test.yml logs --no-color > $GITHUB_WORKSPACE/docker-compose.log || true
 
       - name: Upload logs
         if: always()

.github/workflows/pr-python-tests.yml

@@ -32,7 +32,7 @@ jobs:
     - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # ratchet:runs-on/action@v2
 
     - name: Checkout code
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
       with:
         persist-credentials: false
 

.github/workflows/pr-quality-checks.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -38,7 +38,7 @@ jobs:
       - name: Install node dependencies
         working-directory: ./web
         run: npm ci
-      - uses: j178/prek-action@9d6a3097e0c1865ecce00cfb89fe80f2ee91b547 # ratchet:j178/prek-action@v1
+      - uses: j178/prek-action@91fd7d7cf70ae1dee9f4f44e7dfa5d1073fe6623 # ratchet:j178/prek-action@v1
         with:
           prek-version: '0.2.21'
           extra-args: ${{ github.event_name == 'pull_request' && format('--from-ref {0} --to-ref {1}', github.event.pull_request.base.sha, github.event.pull_request.head.sha) || github.event_name == 'merge_group' && format('--from-ref {0} --to-ref {1}', github.event.merge_group.base_sha, github.event.merge_group.head_sha) || github.ref_name == 'main' && '--all-files' || '' }}

.github/workflows/release-devtools.yml

@@ -24,11 +24,11 @@ jobs:
           - { goos: "darwin", goarch: "arm64" }
           - { goos: "", goarch: "" }
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           persist-credentials: false
           fetch-depth: 0
-      - uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # ratchet:astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@ed21f2f24f8dd64503750218de024bcf64c7250a # ratchet:astral-sh/setup-uv@v7
         with:
           enable-cache: false
           version: "0.9.9"

.github/workflows/sync_foss.yml

@@ -14,7 +14,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout main Onyx repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           fetch-depth: 0
           persist-credentials: false

.github/workflows/tag-nightly.yml

@@ -18,7 +18,7 @@ jobs:
       # see https://github.com/orgs/community/discussions/27028#discussioncomment-3254367 for the workaround we
       # implement here which needs an actual user's deploy key
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6
         with:
           ssh-key: "${{ secrets.DEPLOY_KEY }}"
           persist-credentials: true

.github/workflows/zizmor.yml

@@ -17,7 +17,7 @@ jobs:
       security-events: write # needed for SARIF uploads
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6.0.1
         with:
           persist-credentials: false
 
@@ -31,7 +31,7 @@ jobs:
 
       - name: Install the latest version of uv
         if: steps.filter.outputs.zizmor == 'true' || github.ref_name == 'main'
-        uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # ratchet:astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@ed21f2f24f8dd64503750218de024bcf64c7250a # ratchet:astral-sh/setup-uv@v7
         with:
           enable-cache: false
           version: "0.9.9"

.gitignore

@@ -1,9 +1,5 @@
 # editors
-.vscode/*
-!/.vscode/env_template.txt
-!/.vscode/env.web_template.txt
-!/.vscode/launch.json
-!/.vscode/tasks.template.jsonc
+.vscode
 .zed
 .cursor
 

.pre-commit-config.yaml

@@ -66,8 +66,7 @@ repos:
       - id: uv-run
         name: Check lazy imports
         args: ["--active", "--with=onyx-devtools", "ods", "check-lazy-imports"]
-        pass_filenames: true
-        files: ^backend/(?!\.venv/|scripts/).*\.py$
+        files: ^backend/(?!\.venv/).*\.py$
       # NOTE: This takes ~6s on a single, large module which is prohibitively slow.
       # - id: uv-run
       #   name: mypy
@@ -75,13 +74,6 @@ repos:
       #   pass_filenames: true
       #   files: ^backend/.*\.py$
 
-  - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # frozen: v6.0.0
-    hooks:
-      - id: check-added-large-files
-        name: Check for added large files
-        args: ["--maxkb=1500"]
-
   - repo: https://github.com/rhysd/actionlint
     rev: a443f344ff32813837fa49f7aa6cbc478d770e62 # frozen: v1.7.9
     hooks:
@@ -154,22 +146,6 @@ repos:
         pass_filenames: false
         files: \.tf$
 
-      - id: npm-install
-        name: npm install
-        description: "Automatically run 'npm install' after a checkout, pull or rebase"
-        language: system
-        entry: bash -c 'cd web && npm install --no-save'
-        pass_filenames: false
-        files: ^web/package(-lock)?\.json$
-        stages: [post-checkout, post-merge, post-rewrite]
-      - id: npm-install-check
-        name: npm install --package-lock-only
-        description: "Check the 'web/package-lock.json' is updated"
-        language: system
-        entry: bash -c 'cd web && npm install --package-lock-only'
-        pass_filenames: false
-        files: ^web/package(-lock)?\.json$
-
       # Uses tsgo (TypeScript's native Go compiler) for ~10x faster type checking.
       # This is a preview package - if it breaks:
       #   1. Try updating: cd web && npm update @typescript/native-preview

.vscode/env.web_template.txt

@@ -1,16 +0,0 @@
-# Copy this file to .env.web in the .vscode folder.
-# Fill in the <REPLACE THIS> values as needed
-# Web Server specific environment variables
-# Minimal set needed for Next.js dev server
-
-# Auth
-AUTH_TYPE=basic
-DEV_MODE=true
-
-# Enable the full set of Danswer Enterprise Edition features.
-# NOTE: DO NOT ENABLE THIS UNLESS YOU HAVE A PAID ENTERPRISE LICENSE (or if you
-# are using this for local testing/development).
-ENABLE_PAID_ENTERPRISE_EDITION_FEATURES=false
-
-# Enable Onyx Craft
-ENABLE_CRAFT=true

.vscode/env_template.txt

@@ -6,17 +6,23 @@
 # processes.
 
 
-AUTH_TYPE=basic
-DEV_MODE=true
+# For local dev, often user Authentication is not needed.
+AUTH_TYPE=disabled
 
 
 # Always keep these on for Dev.
 # Logs model prompts, reasoning, and answer to stdout.
-LOG_ONYX_MODEL_INTERACTIONS=False
+LOG_ONYX_MODEL_INTERACTIONS=True
 # More verbose logging
 LOG_LEVEL=debug
 
 
+# This passes top N results to LLM an additional time for reranking prior to
+# answer generation.
+# This step is quite heavy on token usage so we disable it for dev generally.
+DISABLE_LLM_DOC_RELEVANCE=False
+
+
 # Useful if you want to toggle auth on/off (google_oauth/OIDC specifically).
 OAUTH_CLIENT_ID=<REPLACE THIS>
 OAUTH_CLIENT_SECRET=<REPLACE THIS>
@@ -35,6 +41,7 @@ GEN_AI_API_KEY=<REPLACE THIS>
 OPENAI_API_KEY=<REPLACE THIS>
 # If answer quality isn't important for dev, use gpt-4o-mini since it's cheaper.
 GEN_AI_MODEL_VERSION=gpt-4o
+FAST_GEN_AI_MODEL_VERSION=gpt-4o
 
 
 # Python stuff

.vscode/launch.template.jsonc

@@ -1,3 +1,5 @@
+/* Copy this file into '.vscode/launch.json' or merge its contents into your existing configurations. */
+
 {
   // Use IntelliSense to learn about possible attributes.
   // Hover to view descriptions of existing attributes.
@@ -22,10 +24,9 @@
         "Slack Bot",
         "Celery primary",
         "Celery light",
-        "Celery heavy",
+        "Celery background",
         "Celery docfetching",
         "Celery docprocessing",
-        "Celery user_file_processing",
         "Celery beat"
       ],
       "presentation": {
@@ -87,7 +88,7 @@
       "request": "launch",
       "cwd": "${workspaceRoot}/web",
       "runtimeExecutable": "npm",
-      "envFile": "${workspaceFolder}/.vscode/.env.web",
+      "envFile": "${workspaceFolder}/.vscode/.env",
       "runtimeArgs": ["run", "dev"],
       "presentation": {
         "group": "2"
@@ -122,6 +123,7 @@
       "cwd": "${workspaceFolder}/backend",
       "envFile": "${workspaceFolder}/.vscode/.env",
       "env": {
+        "LOG_ONYX_MODEL_INTERACTIONS": "True",
         "LOG_LEVEL": "DEBUG",
         "PYTHONUNBUFFERED": "1"
       },
@@ -149,24 +151,6 @@
       },
       "consoleTitle": "Slack Bot Console"
     },
-    {
-      "name": "Discord Bot",
-      "consoleName": "Discord Bot",
-      "type": "debugpy",
-      "request": "launch",
-      "program": "onyx/onyxbot/discord/client.py",
-      "cwd": "${workspaceFolder}/backend",
-      "envFile": "${workspaceFolder}/.vscode/.env",
-      "env": {
-        "LOG_LEVEL": "DEBUG",
-        "PYTHONUNBUFFERED": "1",
-        "PYTHONPATH": "."
-      },
-      "presentation": {
-        "group": "2"
-      },
-      "consoleTitle": "Discord Bot Console"
-    },
     {
       "name": "MCP Server",
       "consoleName": "MCP Server",
@@ -415,6 +399,7 @@
         "onyx.background.celery.versioned_apps.docfetching",
         "worker",
         "--pool=threads",
+        "--concurrency=1",
         "--prefetch-multiplier=1",
         "--loglevel=INFO",
         "--hostname=docfetching@%n",
@@ -445,6 +430,7 @@
         "onyx.background.celery.versioned_apps.docprocessing",
         "worker",
         "--pool=threads",
+        "--concurrency=6",
         "--prefetch-multiplier=1",
         "--loglevel=INFO",
         "--hostname=docprocessing@%n",
@@ -572,6 +558,7 @@
       "cwd": "${workspaceFolder}/backend",
       "envFile": "${workspaceFolder}/.vscode/.env",
       "env": {
+        "LOG_ONYX_MODEL_INTERACTIONS": "True",
         "LOG_LEVEL": "DEBUG",
         "PYTHONUNBUFFERED": "1",
         "PYTHONPATH": "."
@@ -592,137 +579,6 @@
         "group": "3"
       }
     },
-    {
-      "name": "Build Sandbox Templates",
-      "type": "debugpy",
-      "request": "launch",
-      "module": "onyx.server.features.build.sandbox.build_templates",
-      "cwd": "${workspaceFolder}/backend",
-      "envFile": "${workspaceFolder}/.vscode/.env",
-      "env": {
-        "PYTHONUNBUFFERED": "1",
-        "PYTHONPATH": "."
-      },
-      "console": "integratedTerminal",
-      "presentation": {
-        "group": "3"
-      },
-      "consoleTitle": "Build Sandbox Templates"
-    },
-    {
-      // Dummy entry used to label the group
-      "name": "--- Database ---",
-      "type": "node",
-      "request": "launch",
-      "presentation": {
-        "group": "4",
-        "order": 0
-      }
-    },
-    {
-      "name": "Restore seeded database dump",
-      "type": "node",
-      "request": "launch",
-      "runtimeExecutable": "uv",
-      "runtimeArgs": [
-        "run",
-        "--with",
-        "onyx-devtools",
-        "ods",
-        "db",
-        "restore",
-        "--fetch-seeded",
-        "--yes"
-      ],
-      "cwd": "${workspaceFolder}",
-      "console": "integratedTerminal",
-      "presentation": {
-        "group": "4"
-      }
-    },
-    {
-      "name": "Clean restore seeded database dump (destructive)",
-      "type": "node",
-      "request": "launch",
-      "runtimeExecutable": "uv",
-      "runtimeArgs": [
-        "run",
-        "--with",
-        "onyx-devtools",
-        "ods",
-        "db",
-        "restore",
-        "--fetch-seeded",
-        "--clean",
-        "--yes"
-      ],
-      "cwd": "${workspaceFolder}",
-      "console": "integratedTerminal",
-      "presentation": {
-        "group": "4"
-      }
-    },
-    {
-      "name": "Create database snapshot",
-      "type": "node",
-      "request": "launch",
-      "runtimeExecutable": "uv",
-      "runtimeArgs": [
-        "run",
-        "--with",
-        "onyx-devtools",
-        "ods",
-        "db",
-        "dump",
-        "backup.dump"
-      ],
-      "cwd": "${workspaceFolder}",
-      "console": "integratedTerminal",
-      "presentation": {
-        "group": "4"
-      }
-    },
-    {
-      "name": "Clean restore database snapshot (destructive)",
-      "type": "node",
-      "request": "launch",
-      "runtimeExecutable": "uv",
-      "runtimeArgs": [
-        "run",
-        "--with",
-        "onyx-devtools",
-        "ods",
-        "db",
-        "restore",
-        "--clean",
-        "--yes",
-        "backup.dump"
-      ],
-      "cwd": "${workspaceFolder}",
-      "console": "integratedTerminal",
-      "presentation": {
-        "group": "4"
-      }
-    },
-    {
-      "name": "Upgrade database to head revision",
-      "type": "node",
-      "request": "launch",
-      "runtimeExecutable": "uv",
-      "runtimeArgs": [
-        "run",
-        "--with",
-        "onyx-devtools",
-        "ods",
-        "db",
-        "upgrade"
-      ],
-      "cwd": "${workspaceFolder}",
-      "console": "integratedTerminal",
-      "presentation": {
-        "group": "4"
-      }
-    },
     {
       // script to generate the openapi schema
       "name": "Onyx OpenAPI Schema Generator",

CONTRIBUTING.md

@@ -1,31 +1,262 @@
+<!-- ONYX_METADATA={"link": "https://github.com/onyx-dot-app/onyx/blob/main/CONTRIBUTING.md"} -->
+
 # Contributing to Onyx
+
 Hey there! We are so excited that you're interested in Onyx.
 
+As an open source project in a rapidly changing space, we welcome all contributions.
 
-## Contribution Opportunities
-The [GitHub Issues](https://github.com/onyx-dot-app/onyx/issues) page is a great place to look for and share contribution ideas.
+## 💃 Guidelines
 
-If you have your own feature that you would like to build please create an issue and community members can provide feedback and
-thumb it up if they feel a common need. 
+### Contribution Opportunities
 
+The [GitHub Issues](https://github.com/onyx-dot-app/onyx/issues) page is a great place to start for contribution ideas.
 
-## Contributing Code
-Please reference the documents in contributing_guides folder to ensure that the code base is kept to a high standard.
-1. dev_setup.md (start here): gives you a guide to setting up a local development environment.
-2. contribution_process.md: how to ensure you are building valuable features that will get reviewed and merged.
-3. best_practices.md: before asking for reviews, ensure your changes meet the repo code quality standards.
+To ensure that your contribution is aligned with the project's direction, please reach out to any maintainer on the Onyx team
+via [Discord](https://discord.gg/4NA5SbzrWb) or [email](mailto:hello@onyx.app).
 
-To contribute, please follow the
+Issues that have been explicitly approved by the maintainers (aligned with the direction of the project)
+will be marked with the `approved by maintainers` label.
+Issues marked `good first issue` are an especially great place to start.
+
+**Connectors** to other tools are another great place to contribute. For details on how, refer to this
+[README.md](https://github.com/onyx-dot-app/onyx/blob/main/backend/onyx/connectors/README.md).
+
+If you have a new/different contribution in mind, we'd love to hear about it!
+Your input is vital to making sure that Onyx moves in the right direction.
+Before starting on implementation, please raise a GitHub issue.
+
+Also, always feel free to message the founders (Chris Weaver / Yuhong Sun) on
+[Discord](https://discord.gg/4NA5SbzrWb) directly about anything at all.
+
+### Contributing Code
+
+To contribute to this project, please follow the
 ["fork and pull request"](https://docs.github.com/en/get-started/quickstart/contributing-to-projects) workflow.
+When opening a pull request, mention related issues and feel free to tag relevant maintainers.
+
+Before creating a pull request please make sure that the new changes conform to the formatting and linting requirements.
+See the [Formatting and Linting](#formatting-and-linting) section for how to run these checks locally.
+
+### Getting Help 🙋
+
+Our goal is to make contributing as easy as possible. If you run into any issues please don't hesitate to reach out.
+That way we can help future contributors and users can avoid the same issue.
+
+We also have support channels and generally interesting discussions on our
+[Discord](https://discord.gg/4NA5SbzrWb).
+
+We would love to see you there!
+
+## Get Started 🚀
+
+Onyx being a fully functional app, relies on some external software, specifically:
+
+- [Postgres](https://www.postgresql.org/) (Relational DB)
+- [Vespa](https://vespa.ai/) (Vector DB/Search Engine)
+- [Redis](https://redis.io/) (Cache)
+- [MinIO](https://min.io/) (File Store)
+- [Nginx](https://nginx.org/) (Not needed for development flows generally)
+
+> **Note:**
+> This guide provides instructions to build and run Onyx locally from source with Docker containers providing the above external software. We believe this combination is easier for
+> development purposes. If you prefer to use pre-built container images, we provide instructions on running the full Onyx stack within Docker below.
+
+### Local Set Up
+
+Be sure to use Python version 3.11. For instructions on installing Python 3.11 on macOS, refer to the [CONTRIBUTING_MACOS.md](./CONTRIBUTING_MACOS.md) readme.
+
+If using a lower version, modifications will have to be made to the code.
+If using a higher version, sometimes some libraries will not be available (i.e. we had problems with Tensorflow in the past with higher versions of python).
+
+#### Backend: Python requirements
+
+Currently, we use [uv](https://docs.astral.sh/uv/) and recommend creating a [virtual environment](https://docs.astral.sh/uv/pip/environments/#using-a-virtual-environment).
+
+For convenience here's a command for it:
+
+```bash
+uv venv .venv --python 3.11
+source .venv/bin/activate
+```
+
+_For Windows, activate the virtual environment using Command Prompt:_
+
+```bash
+.venv\Scripts\activate
+```
+
+If using PowerShell, the command slightly differs:
+
+```powershell
+.venv\Scripts\Activate.ps1
+```
+
+Install the required python dependencies:
+
+```bash
+uv sync --all-extras
+```
+
+Install Playwright for Python (headless browser required by the Web Connector):
+
+```bash
+uv run playwright install
+```
+
+#### Frontend: Node dependencies
+
+Onyx uses Node v22.20.0. We highly recommend you use [Node Version Manager (nvm)](https://github.com/nvm-sh/nvm)
+to manage your Node installations. Once installed, you can run
+
+```bash
+nvm install 22 && nvm use 22
+node -v # verify your active version
+```
+
+Navigate to `onyx/web` and run:
+
+```bash
+npm i
+```
+
+## Formatting and Linting
+
+### Backend
+
+For the backend, you'll need to setup pre-commit hooks (black / reorder-python-imports).
+
+Then run:
+
+```bash
+uv run pre-commit install
+```
+
+Additionally, we use `mypy` for static type checking.
+Onyx is fully type-annotated, and we want to keep it that way!
+To run the mypy checks manually, run `uv run mypy .` from the `onyx/backend` directory.
+
+### Web
+
+We use `prettier` for formatting. The desired version will be installed via a `npm i` from the `onyx/web` directory.
+To run the formatter, use `npx prettier --write .` from the `onyx/web` directory.
+
+Pre-commit will also run prettier automatically on files you've recently touched. If re-formatted, your commit will fail.
+Re-stage your changes and commit again.
+
+# Running the application for development
+
+## Developing using VSCode Debugger (recommended)
+
+**We highly recommend using VSCode debugger for development.**
+See [CONTRIBUTING_VSCODE.md](./CONTRIBUTING_VSCODE.md) for more details.
+
+Otherwise, you can follow the instructions below to run the application for development.
+
+## Manually running the application for development
+### Docker containers for external software
+
+You will need Docker installed to run these containers.
+
+First navigate to `onyx/deployment/docker_compose`, then start up Postgres/Vespa/Redis/MinIO with:
+
+```bash
+docker compose -f docker-compose.yml -f docker-compose.dev.yml up -d index relational_db cache minio
+```
+
+(index refers to Vespa, relational_db refers to Postgres, and cache refers to Redis)
+
+### Running Onyx locally
+
+To start the frontend, navigate to `onyx/web` and run:
+
+```bash
+npm run dev
+```
+
+Next, start the model server which runs the local NLP models.
+Navigate to `onyx/backend` and run:
+
+```bash
+uvicorn model_server.main:app --reload --port 9000
+```
+
+_For Windows (for compatibility with both PowerShell and Command Prompt):_
+
+```bash
+powershell -Command "uvicorn model_server.main:app --reload --port 9000"
+```
+
+The first time running Onyx, you will need to run the DB migrations for Postgres.
+After the first time, this is no longer required unless the DB models change.
+
+Navigate to `onyx/backend` and with the venv active, run:
+
+```bash
+alembic upgrade head
+```
+
+Next, start the task queue which orchestrates the background jobs.
+Jobs that take more time are run async from the API server.
+
+Still in `onyx/backend`, run:
+
+```bash
+python ./scripts/dev_run_background_jobs.py
+```
+
+To run the backend API server, navigate back to `onyx/backend` and run:
+
+```bash
+AUTH_TYPE=disabled uvicorn onyx.main:app --reload --port 8080
+```
+
+_For Windows (for compatibility with both PowerShell and Command Prompt):_
+
+```bash
+powershell -Command "
+    $env:AUTH_TYPE='disabled'
+    uvicorn onyx.main:app --reload --port 8080
+"
+```
+
+> **Note:**
+> If you need finer logging, add the additional environment variable `LOG_LEVEL=DEBUG` to the relevant services.
+
+#### Wrapping up
+
+You should now have 4 servers running:
+
+- Web server
+- Backend API
+- Model server
+- Background jobs
+
+Now, visit `http://localhost:3000` in your browser. You should see the Onyx onboarding wizard where you can connect your external LLM provider to Onyx.
+
+You've successfully set up a local Onyx instance! 🏁
+
+#### Running the Onyx application in a container
+
+You can run the full Onyx application stack from pre-built images including all external software dependencies.
+
+Navigate to `onyx/deployment/docker_compose` and run:
+
+```bash
+docker compose up -d
+```
+
+After Docker pulls and starts these containers, navigate to `http://localhost:3000` to use Onyx.
+
+If you want to make changes to Onyx and run those changes in Docker, you can also build a local version of the Onyx container images that incorporates your changes like so:
+
+```bash
+docker compose up -d --build
+```
 
 
-## Getting Help 🙋
-We have support channels and generally interesting discussions on our [Discord](https://discord.gg/4NA5SbzrWb).
+### Release Process
 
-See you there!
-
-
-## Release Process
 Onyx loosely follows the SemVer versioning standard.
 Major changes are released with a "minor" version bump. Currently we use patch release versions to indicate small feature changes.
 A set of Docker containers will be pushed automatically to DockerHub with every tag.

CONTRIBUTING_VSCODE.md

@@ -7,6 +7,8 @@ This guide explains how to set up and use VSCode's debugging capabilities with t
 1. **Environment Setup**:
    - Copy `.vscode/env_template.txt` to `.vscode/.env`
    - Fill in the necessary environment variables in `.vscode/.env`
+2. **launch.json**:
+   - Copy `.vscode/launch.template.jsonc` to `.vscode/launch.json`
 
 ## Using the Debugger
 

backend/.dockerignore

@@ -16,8 +16,3 @@ dist/
 .coverage
 htmlcov/
 model_server/legacy/
-
-# Craft: demo_data directory should be unzipped at container startup, not copied
-**/demo_data/
-# Craft: templates/outputs/venv is created at container startup
-**/templates/outputs/venv

backend/.trivyignore

@@ -37,6 +37,10 @@ CVE-2023-50868
 CVE-2023-52425
 CVE-2024-28757
 
+# sqlite, only used by NLTK library to grab word lemmatizer and stopwords
+# No impact in our settings
+CVE-2023-7104
+
 # libharfbuzz0b, O(n^2) growth, worst case is denial of service
 # Accept the risk
 CVE-2023-25193

backend/Dockerfile

@@ -7,10 +7,6 @@ have a contract or agreement with DanswerAI, you are not permitted to use the En
 Edition features outside of personal development or testing purposes. Please reach out to \
 founders@onyx.app for more information. Please visit https://github.com/onyx-dot-app/onyx"
 
-# Build argument for Craft support (disabled by default)
-# Use --build-arg ENABLE_CRAFT=true to include Node.js and opencode CLI
-ARG ENABLE_CRAFT=false
-
 # DO_NOT_TRACK is used to disable telemetry for Unstructured
 ENV DANSWER_RUNNING_IN_DOCKER="true" \
     DO_NOT_TRACK="true" \
@@ -50,23 +46,7 @@ RUN apt-get update && \
     rm -rf /var/lib/apt/lists/* && \
     apt-get clean
 
-# Conditionally install Node.js 20 for Craft (required for Next.js)
-# Only installed when ENABLE_CRAFT=true
-RUN if [ "$ENABLE_CRAFT" = "true" ]; then \
-        echo "Installing Node.js 20 for Craft support..." && \
-        curl -fsSL https://deb.nodesource.com/setup_20.x | bash - && \
-        apt-get install -y nodejs && \
-        rm -rf /var/lib/apt/lists/*; \
-    fi
 
-# Conditionally install opencode CLI for Craft agent functionality
-# Only installed when ENABLE_CRAFT=true
-# TODO: download a specific, versioned release of the opencode CLI
-RUN if [ "$ENABLE_CRAFT" = "true" ]; then \
-        echo "Installing opencode CLI for Craft support..." && \
-        curl -fsSL https://opencode.ai/install | bash; \
-    fi
-ENV PATH="/root/.opencode/bin:${PATH}"
 
 # Install Python dependencies
 # Remove py which is pulled in by retry, py is not needed and is a CVE
@@ -111,8 +91,8 @@ Tokenizer.from_pretrained('nomic-ai/nomic-embed-text-v1')"
 
 # Pre-downloading NLTK for setups with limited egress
 RUN python -c "import nltk; \
-    nltk.download('stopwords', quiet=True); \
-    nltk.download('punkt_tab', quiet=True);"
+nltk.download('stopwords', quiet=True); \
+nltk.download('punkt_tab', quiet=True);"
 # nltk.download('wordnet', quiet=True); introduce this back if lemmatization is needed
 
 # Pre-downloading tiktoken for setups with limited egress
@@ -139,15 +119,7 @@ COPY --chown=onyx:onyx ./static /app/static
 COPY --chown=onyx:onyx ./scripts/debugging /app/scripts/debugging
 COPY --chown=onyx:onyx ./scripts/force_delete_connector_by_id.py /app/scripts/force_delete_connector_by_id.py
 COPY --chown=onyx:onyx ./scripts/supervisord_entrypoint.sh /app/scripts/supervisord_entrypoint.sh
-COPY --chown=onyx:onyx ./scripts/setup_craft_templates.sh /app/scripts/setup_craft_templates.sh
-RUN chmod +x /app/scripts/supervisord_entrypoint.sh /app/scripts/setup_craft_templates.sh
-
-# Run Craft template setup at build time when ENABLE_CRAFT=true
-# This pre-bakes demo data, Python venv, and npm dependencies into the image
-RUN if [ "$ENABLE_CRAFT" = "true" ]; then \
-        echo "Running Craft template setup at build time..." && \
-        ENABLE_CRAFT=true /app/scripts/setup_craft_templates.sh; \
-    fi
+RUN chmod +x /app/scripts/supervisord_entrypoint.sh
 
 # Put logo in assets
 COPY --chown=onyx:onyx ./assets /app/assets

backend/alembic/versions/001984c88745_llmprovider_deprecated_fields_are_.py

@@ -1,58 +0,0 @@
-"""LLMProvider deprecated fields are nullable
-
-Revision ID: 001984c88745
-Revises: 01f8e6d95a33
-Create Date: 2026-02-01 22:24:34.171100
-
-"""
-
-from alembic import op
-import sqlalchemy as sa
-
-
-# revision identifiers, used by Alembic.
-revision = "001984c88745"
-down_revision = "01f8e6d95a33"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    # Make default_model_name nullable (was NOT NULL)
-    op.alter_column(
-        "llm_provider",
-        "default_model_name",
-        existing_type=sa.String(),
-        nullable=True,
-    )
-
-    # Remove server_default from is_default_vision_provider (was server_default=false())
-    op.alter_column(
-        "llm_provider",
-        "is_default_vision_provider",
-        existing_type=sa.Boolean(),
-        server_default=None,
-    )
-
-    # is_default_provider and default_vision_model are already nullable with no server_default
-
-
-def downgrade() -> None:
-    # Restore default_model_name to NOT NULL (set empty string for any NULLs first)
-    op.execute(
-        "UPDATE llm_provider SET default_model_name = '' WHERE default_model_name IS NULL"
-    )
-    op.alter_column(
-        "llm_provider",
-        "default_model_name",
-        existing_type=sa.String(),
-        nullable=False,
-    )
-
-    # Restore server_default for is_default_vision_provider
-    op.alter_column(
-        "llm_provider",
-        "is_default_vision_provider",
-        existing_type=sa.Boolean(),
-        server_default=sa.false(),
-    )

backend/alembic/versions/01f8e6d95a33_populate_flow_mapping_data.py

@@ -1,112 +0,0 @@
-"""Populate flow mapping data
-
-Revision ID: 01f8e6d95a33
-Revises: f220515df7b4
-Create Date: 2026-01-31 17:37:10.485558
-
-"""
-
-from alembic import op
-
-
-# revision identifiers, used by Alembic.
-revision = "01f8e6d95a33"
-down_revision = "f220515df7b4"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    # Add each model config to the conversation flow, setting the global default if it exists
-    # Exclude models that are part of ImageGenerationConfig
-    op.execute(
-        """
-        INSERT INTO llm_model_flow (llm_model_flow_type, is_default, model_configuration_id)
-        SELECT
-            'chat' AS llm_model_flow_type,
-            COALESCE(
-                (lp.is_default_provider IS TRUE AND lp.default_model_name = mc.name),
-                FALSE
-            ) AS is_default,
-            mc.id AS model_configuration_id
-        FROM model_configuration mc
-        LEFT JOIN llm_provider lp
-            ON lp.id = mc.llm_provider_id
-        WHERE NOT EXISTS (
-            SELECT 1 FROM image_generation_config igc
-            WHERE igc.model_configuration_id = mc.id
-        );
-        """
-    )
-
-    # Add models with supports_image_input to the vision flow
-    op.execute(
-        """
-        INSERT INTO llm_model_flow (llm_model_flow_type, is_default, model_configuration_id)
-        SELECT
-            'vision' AS llm_model_flow_type,
-            COALESCE(
-                (lp.is_default_vision_provider IS TRUE AND lp.default_vision_model = mc.name),
-                FALSE
-            ) AS is_default,
-            mc.id AS model_configuration_id
-        FROM model_configuration mc
-        LEFT JOIN llm_provider lp
-            ON lp.id = mc.llm_provider_id
-        WHERE mc.supports_image_input IS TRUE;
-        """
-    )
-
-
-def downgrade() -> None:
-    # Populate vision defaults from model_flow
-    op.execute(
-        """
-        UPDATE llm_provider AS lp
-        SET
-            is_default_vision_provider = TRUE,
-            default_vision_model = mc.name
-        FROM llm_model_flow mf
-        JOIN model_configuration mc ON mc.id = mf.model_configuration_id
-        WHERE mf.llm_model_flow_type = 'vision'
-          AND mf.is_default = TRUE
-          AND mc.llm_provider_id = lp.id;
-        """
-    )
-
-    # Populate conversation defaults from model_flow
-    op.execute(
-        """
-        UPDATE llm_provider AS lp
-        SET
-            is_default_provider = TRUE,
-            default_model_name = mc.name
-        FROM llm_model_flow mf
-        JOIN model_configuration mc ON mc.id = mf.model_configuration_id
-        WHERE mf.llm_model_flow_type = 'chat'
-          AND mf.is_default = TRUE
-          AND mc.llm_provider_id = lp.id;
-        """
-    )
-
-    # For providers that have conversation flow mappings but aren't the default,
-    # we still need a default_model_name (it was NOT NULL originally)
-    # Pick the first visible model or any model for that provider
-    op.execute(
-        """
-        UPDATE llm_provider AS lp
-        SET default_model_name = (
-            SELECT mc.name
-            FROM model_configuration mc
-            JOIN llm_model_flow mf ON mf.model_configuration_id = mc.id
-            WHERE mc.llm_provider_id = lp.id
-              AND mf.llm_model_flow_type = 'chat'
-            ORDER BY mc.is_visible DESC, mc.id ASC
-            LIMIT 1
-        )
-        WHERE lp.default_model_name IS NULL;
-        """
-    )
-
-    # Delete all model_flow entries (reverse the inserts from upgrade)
-    op.execute("DELETE FROM llm_model_flow;")

backend/alembic/versions/1f60f60c3401_embedding_model_search_settings.py

@@ -10,6 +10,8 @@ from alembic import op
 import sqlalchemy as sa
 from sqlalchemy.dialects import postgresql
 
+from onyx.configs.chat_configs import NUM_POSTPROCESSED_RESULTS
+
 # revision identifiers, used by Alembic.
 revision = "1f60f60c3401"
 down_revision = "f17bf3b0d9f1"
@@ -64,7 +66,7 @@ def upgrade() -> None:
             "num_rerank",
             sa.Integer(),
             nullable=False,
-            server_default=str(20),
+            server_default=str(NUM_POSTPROCESSED_RESULTS),
         ),
     )
 

backend/alembic/versions/2020d417ec84_single_onyx_craft_migration.py

@@ -1,351 +0,0 @@
-"""single onyx craft migration
-
-Consolidates all buildmode/onyx craft tables into a single migration.
-
-Tables created:
-- build_session: User build sessions with status tracking
-- sandbox: User-owned containerized environments (one per user)
-- artifact: Build output files (web apps, documents, images)
-- snapshot: Sandbox filesystem snapshots
-- build_message: Conversation messages for build sessions
-
-Existing table modified:
-- connector_credential_pair: Added processing_mode column
-
-Revision ID: 2020d417ec84
-Revises: 41fa44bef321
-Create Date: 2026-01-26 14:43:54.641405
-
-"""
-
-from alembic import op
-import sqlalchemy as sa
-from sqlalchemy.dialects import postgresql
-
-
-# revision identifiers, used by Alembic.
-revision = "2020d417ec84"
-down_revision = "41fa44bef321"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    # ==========================================================================
-    # ENUMS
-    # ==========================================================================
-
-    # Build session status enum
-    build_session_status_enum = sa.Enum(
-        "active",
-        "idle",
-        name="buildsessionstatus",
-        native_enum=False,
-    )
-
-    # Sandbox status enum
-    sandbox_status_enum = sa.Enum(
-        "provisioning",
-        "running",
-        "idle",
-        "sleeping",
-        "terminated",
-        "failed",
-        name="sandboxstatus",
-        native_enum=False,
-    )
-
-    # Artifact type enum
-    artifact_type_enum = sa.Enum(
-        "web_app",
-        "pptx",
-        "docx",
-        "markdown",
-        "excel",
-        "image",
-        name="artifacttype",
-        native_enum=False,
-    )
-
-    # ==========================================================================
-    # BUILD_SESSION TABLE
-    # ==========================================================================
-
-    op.create_table(
-        "build_session",
-        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
-        sa.Column(
-            "user_id",
-            postgresql.UUID(as_uuid=True),
-            sa.ForeignKey("user.id", ondelete="CASCADE"),
-            nullable=True,
-        ),
-        sa.Column("name", sa.String(), nullable=True),
-        sa.Column(
-            "status",
-            build_session_status_enum,
-            nullable=False,
-            server_default="active",
-        ),
-        sa.Column(
-            "created_at",
-            sa.DateTime(timezone=True),
-            server_default=sa.text("now()"),
-            nullable=False,
-        ),
-        sa.Column(
-            "last_activity_at",
-            sa.DateTime(timezone=True),
-            server_default=sa.text("now()"),
-            nullable=False,
-        ),
-        sa.Column("nextjs_port", sa.Integer(), nullable=True),
-        sa.PrimaryKeyConstraint("id"),
-    )
-
-    op.create_index(
-        "ix_build_session_user_created",
-        "build_session",
-        ["user_id", sa.text("created_at DESC")],
-        unique=False,
-    )
-    op.create_index(
-        "ix_build_session_status",
-        "build_session",
-        ["status"],
-        unique=False,
-    )
-
-    # ==========================================================================
-    # SANDBOX TABLE (user-owned, one per user)
-    # ==========================================================================
-
-    op.create_table(
-        "sandbox",
-        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
-        sa.Column(
-            "user_id",
-            postgresql.UUID(as_uuid=True),
-            sa.ForeignKey("user.id", ondelete="CASCADE"),
-            nullable=False,
-        ),
-        sa.Column("container_id", sa.String(), nullable=True),
-        sa.Column(
-            "status",
-            sandbox_status_enum,
-            nullable=False,
-            server_default="provisioning",
-        ),
-        sa.Column(
-            "created_at",
-            sa.DateTime(timezone=True),
-            server_default=sa.text("now()"),
-            nullable=False,
-        ),
-        sa.Column("last_heartbeat", sa.DateTime(timezone=True), nullable=True),
-        sa.PrimaryKeyConstraint("id"),
-        sa.UniqueConstraint("user_id", name="sandbox_user_id_key"),
-    )
-
-    op.create_index(
-        "ix_sandbox_status",
-        "sandbox",
-        ["status"],
-        unique=False,
-    )
-    op.create_index(
-        "ix_sandbox_container_id",
-        "sandbox",
-        ["container_id"],
-        unique=False,
-    )
-
-    # ==========================================================================
-    # ARTIFACT TABLE
-    # ==========================================================================
-
-    op.create_table(
-        "artifact",
-        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
-        sa.Column(
-            "session_id",
-            postgresql.UUID(as_uuid=True),
-            sa.ForeignKey("build_session.id", ondelete="CASCADE"),
-            nullable=False,
-        ),
-        sa.Column("type", artifact_type_enum, nullable=False),
-        sa.Column("path", sa.String(), nullable=False),
-        sa.Column("name", sa.String(), nullable=False),
-        sa.Column(
-            "created_at",
-            sa.DateTime(timezone=True),
-            server_default=sa.text("now()"),
-            nullable=False,
-        ),
-        sa.Column(
-            "updated_at",
-            sa.DateTime(timezone=True),
-            server_default=sa.text("now()"),
-            nullable=False,
-        ),
-        sa.PrimaryKeyConstraint("id"),
-    )
-
-    op.create_index(
-        "ix_artifact_session_created",
-        "artifact",
-        ["session_id", sa.text("created_at DESC")],
-        unique=False,
-    )
-    op.create_index(
-        "ix_artifact_type",
-        "artifact",
-        ["type"],
-        unique=False,
-    )
-
-    # ==========================================================================
-    # SNAPSHOT TABLE
-    # ==========================================================================
-
-    op.create_table(
-        "snapshot",
-        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
-        sa.Column(
-            "session_id",
-            postgresql.UUID(as_uuid=True),
-            sa.ForeignKey("build_session.id", ondelete="CASCADE"),
-            nullable=False,
-        ),
-        sa.Column("storage_path", sa.String(), nullable=False),
-        sa.Column("size_bytes", sa.BigInteger(), nullable=False, server_default="0"),
-        sa.Column(
-            "created_at",
-            sa.DateTime(timezone=True),
-            server_default=sa.text("now()"),
-            nullable=False,
-        ),
-        sa.PrimaryKeyConstraint("id"),
-    )
-
-    op.create_index(
-        "ix_snapshot_session_created",
-        "snapshot",
-        ["session_id", sa.text("created_at DESC")],
-        unique=False,
-    )
-
-    # ==========================================================================
-    # BUILD_MESSAGE TABLE
-    # ==========================================================================
-
-    op.create_table(
-        "build_message",
-        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
-        sa.Column(
-            "session_id",
-            postgresql.UUID(as_uuid=True),
-            sa.ForeignKey("build_session.id", ondelete="CASCADE"),
-            nullable=False,
-        ),
-        sa.Column(
-            "turn_index",
-            sa.Integer(),
-            nullable=False,
-        ),
-        sa.Column(
-            "type",
-            sa.Enum(
-                "SYSTEM",
-                "USER",
-                "ASSISTANT",
-                "DANSWER",
-                name="messagetype",
-                create_type=False,
-                native_enum=False,
-            ),
-            nullable=False,
-        ),
-        sa.Column(
-            "message_metadata",
-            postgresql.JSONB(),
-            nullable=False,
-        ),
-        sa.Column(
-            "created_at",
-            sa.DateTime(timezone=True),
-            server_default=sa.text("now()"),
-            nullable=False,
-        ),
-        sa.PrimaryKeyConstraint("id"),
-    )
-
-    op.create_index(
-        "ix_build_message_session_turn",
-        "build_message",
-        ["session_id", "turn_index", sa.text("created_at ASC")],
-        unique=False,
-    )
-
-    # ==========================================================================
-    # CONNECTOR_CREDENTIAL_PAIR MODIFICATION
-    # ==========================================================================
-
-    op.add_column(
-        "connector_credential_pair",
-        sa.Column(
-            "processing_mode",
-            sa.String(),
-            nullable=False,
-            server_default="regular",
-        ),
-    )
-
-
-def downgrade() -> None:
-    # ==========================================================================
-    # CONNECTOR_CREDENTIAL_PAIR MODIFICATION
-    # ==========================================================================
-
-    op.drop_column("connector_credential_pair", "processing_mode")
-
-    # ==========================================================================
-    # BUILD_MESSAGE TABLE
-    # ==========================================================================
-
-    op.drop_index("ix_build_message_session_turn", table_name="build_message")
-    op.drop_table("build_message")
-
-    # ==========================================================================
-    # SNAPSHOT TABLE
-    # ==========================================================================
-
-    op.drop_index("ix_snapshot_session_created", table_name="snapshot")
-    op.drop_table("snapshot")
-
-    # ==========================================================================
-    # ARTIFACT TABLE
-    # ==========================================================================
-
-    op.drop_index("ix_artifact_type", table_name="artifact")
-    op.drop_index("ix_artifact_session_created", table_name="artifact")
-    op.drop_table("artifact")
-    sa.Enum(name="artifacttype").drop(op.get_bind(), checkfirst=True)
-
-    # ==========================================================================
-    # SANDBOX TABLE
-    # ==========================================================================
-
-    op.drop_index("ix_sandbox_container_id", table_name="sandbox")
-    op.drop_index("ix_sandbox_status", table_name="sandbox")
-    op.drop_table("sandbox")
-    sa.Enum(name="sandboxstatus").drop(op.get_bind(), checkfirst=True)
-
-    # ==========================================================================
-    # BUILD_SESSION TABLE
-    # ==========================================================================
-
-    op.drop_index("ix_build_session_status", table_name="build_session")
-    op.drop_index("ix_build_session_user_created", table_name="build_session")
-    op.drop_table("build_session")
-    sa.Enum(name="buildsessionstatus").drop(op.get_bind(), checkfirst=True)

backend/alembic/versions/2c2430828bdf_add_unique_constraint_to_inputprompt_.py

@@ -1,42 +0,0 @@
-"""add_unique_constraint_to_inputprompt_prompt_user_id
-
-Revision ID: 2c2430828bdf
-Revises: fb80bdd256de
-Create Date: 2026-01-20 16:01:54.314805
-
-"""
-
-from alembic import op
-
-
-# revision identifiers, used by Alembic.
-revision = "2c2430828bdf"
-down_revision = "fb80bdd256de"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    # Create unique constraint on (prompt, user_id) for user-owned prompts
-    # This ensures each user can only have one shortcut with a given name
-    op.create_unique_constraint(
-        "uq_inputprompt_prompt_user_id",
-        "inputprompt",
-        ["prompt", "user_id"],
-    )
-
-    # Create partial unique index for public prompts (where user_id IS NULL)
-    # PostgreSQL unique constraints don't enforce uniqueness for NULL values,
-    # so we need a partial index to ensure public prompt names are also unique
-    op.execute(
-        """
-        CREATE UNIQUE INDEX uq_inputprompt_prompt_public
-        ON inputprompt (prompt)
-        WHERE user_id IS NULL
-        """
-    )
-
-
-def downgrade() -> None:
-    op.execute("DROP INDEX IF EXISTS uq_inputprompt_prompt_public")
-    op.drop_constraint("uq_inputprompt_prompt_user_id", "inputprompt", type_="unique")

backend/alembic/versions/41fa44bef321_remove_default_prompt_shortcuts.py

@@ -1,29 +0,0 @@
-"""remove default prompt shortcuts
-
-Revision ID: 41fa44bef321
-Revises: 2c2430828bdf
-Create Date: 2025-01-21
-
-"""
-
-from alembic import op
-
-# revision identifiers, used by Alembic.
-revision = "41fa44bef321"
-down_revision = "2c2430828bdf"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    # Delete any user associations for the default prompts first (foreign key constraint)
-    op.execute(
-        "DELETE FROM inputprompt__user WHERE input_prompt_id IN (SELECT id FROM inputprompt WHERE id < 0)"
-    )
-    # Delete the pre-seeded default prompt shortcuts (they have negative IDs)
-    op.execute("DELETE FROM inputprompt WHERE id < 0")
-
-
-def downgrade() -> None:
-    # We don't restore the default prompts on downgrade
-    pass

backend/alembic/versions/72aa7de2e5cf_make_processing_mode_default_all_caps.py

@@ -1,45 +0,0 @@
-"""make processing mode default all caps
-
-Revision ID: 72aa7de2e5cf
-Revises: 2020d417ec84
-Create Date: 2026-01-26 18:58:47.705253
-
-This migration fixes the ProcessingMode enum value mismatch:
-- SQLAlchemy's Enum with native_enum=False uses enum member NAMES as valid values
-- The original migration stored lowercase VALUES ('regular', 'file_system')
-- This converts existing data to uppercase NAMES ('REGULAR', 'FILE_SYSTEM')
-- Also drops any spurious native PostgreSQL enum type that may have been auto-created
-"""
-
-from alembic import op
-
-
-# revision identifiers, used by Alembic.
-revision = "72aa7de2e5cf"
-down_revision = "2020d417ec84"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    # Convert existing lowercase values to uppercase to match enum member names
-    op.execute(
-        "UPDATE connector_credential_pair SET processing_mode = 'REGULAR' "
-        "WHERE processing_mode = 'regular'"
-    )
-    op.execute(
-        "UPDATE connector_credential_pair SET processing_mode = 'FILE_SYSTEM' "
-        "WHERE processing_mode = 'file_system'"
-    )
-
-    # Update the server default to use uppercase
-    op.alter_column(
-        "connector_credential_pair",
-        "processing_mode",
-        server_default="REGULAR",
-    )
-
-
-def downgrade() -> None:
-    # State prior to this was broken, so we don't want to revert back to it
-    pass

backend/alembic/versions/73e9983e5091_add_search_query_table.py

@@ -1,47 +0,0 @@
-"""add_search_query_table
-
-Revision ID: 73e9983e5091
-Revises: d1b637d7050a
-Create Date: 2026-01-14 14:16:52.837489
-
-"""
-
-from alembic import op
-import sqlalchemy as sa
-from sqlalchemy.dialects import postgresql
-
-# revision identifiers, used by Alembic.
-revision = "73e9983e5091"
-down_revision = "d1b637d7050a"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.create_table(
-        "search_query",
-        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
-        sa.Column(
-            "user_id",
-            postgresql.UUID(as_uuid=True),
-            sa.ForeignKey("user.id"),
-            nullable=False,
-        ),
-        sa.Column("query", sa.String(), nullable=False),
-        sa.Column("query_expansions", postgresql.ARRAY(sa.String()), nullable=True),
-        sa.Column(
-            "created_at",
-            sa.DateTime(timezone=True),
-            nullable=False,
-            server_default=sa.func.now(),
-        ),
-    )
-
-    op.create_index("ix_search_query_user_id", "search_query", ["user_id"])
-    op.create_index("ix_search_query_created_at", "search_query", ["created_at"])
-
-
-def downgrade() -> None:
-    op.drop_index("ix_search_query_created_at", table_name="search_query")
-    op.drop_index("ix_search_query_user_id", table_name="search_query")
-    op.drop_table("search_query")

backend/alembic/versions/776b3bbe9092_remove_remaining_enums.py

@@ -10,7 +10,8 @@ from alembic import op
 import sqlalchemy as sa
 
 from onyx.db.models import IndexModelStatus
-from onyx.context.search.enums import RecencyBiasSetting, SearchType
+from onyx.context.search.enums import RecencyBiasSetting
+from onyx.context.search.enums import SearchType
 
 # revision identifiers, used by Alembic.
 revision = "776b3bbe9092"

backend/alembic/versions/78ebc66946a0_remove_reranking_from_search_settings.py

@@ -1,58 +0,0 @@
-"""remove reranking from search_settings
-
-Revision ID: 78ebc66946a0
-Revises: 849b21c732f8
-Create Date: 2026-01-28
-
-"""
-
-from alembic import op
-import sqlalchemy as sa
-
-# revision identifiers, used by Alembic.
-revision = "78ebc66946a0"
-down_revision = "849b21c732f8"
-branch_labels: None = None
-depends_on: None = None
-
-
-def upgrade() -> None:
-    op.drop_column("search_settings", "disable_rerank_for_streaming")
-    op.drop_column("search_settings", "rerank_model_name")
-    op.drop_column("search_settings", "rerank_provider_type")
-    op.drop_column("search_settings", "rerank_api_key")
-    op.drop_column("search_settings", "rerank_api_url")
-    op.drop_column("search_settings", "num_rerank")
-
-
-def downgrade() -> None:
-    op.add_column(
-        "search_settings",
-        sa.Column(
-            "disable_rerank_for_streaming",
-            sa.Boolean(),
-            nullable=False,
-            server_default="false",
-        ),
-    )
-    op.add_column(
-        "search_settings", sa.Column("rerank_model_name", sa.String(), nullable=True)
-    )
-    op.add_column(
-        "search_settings", sa.Column("rerank_provider_type", sa.String(), nullable=True)
-    )
-    op.add_column(
-        "search_settings", sa.Column("rerank_api_key", sa.String(), nullable=True)
-    )
-    op.add_column(
-        "search_settings", sa.Column("rerank_api_url", sa.String(), nullable=True)
-    )
-    op.add_column(
-        "search_settings",
-        sa.Column(
-            "num_rerank",
-            sa.Integer(),
-            nullable=False,
-            server_default=str(20),
-        ),
-    )

backend/alembic/versions/81c22b1e2e78_hierarchy_nodes_v1.py

@@ -1,349 +0,0 @@
-"""hierarchy_nodes_v1
-
-Revision ID: 81c22b1e2e78
-Revises: 72aa7de2e5cf
-Create Date: 2026-01-13 18:10:01.021451
-
-"""
-
-from alembic import op
-import sqlalchemy as sa
-from sqlalchemy.dialects import postgresql
-
-from onyx.configs.constants import DocumentSource
-
-
-# revision identifiers, used by Alembic.
-revision = "81c22b1e2e78"
-down_revision = "72aa7de2e5cf"
-branch_labels = None
-depends_on = None
-
-
-# Human-readable display names for each source
-SOURCE_DISPLAY_NAMES: dict[str, str] = {
-    "ingestion_api": "Ingestion API",
-    "slack": "Slack",
-    "web": "Web",
-    "google_drive": "Google Drive",
-    "gmail": "Gmail",
-    "requesttracker": "Request Tracker",
-    "github": "GitHub",
-    "gitbook": "GitBook",
-    "gitlab": "GitLab",
-    "guru": "Guru",
-    "bookstack": "BookStack",
-    "outline": "Outline",
-    "confluence": "Confluence",
-    "jira": "Jira",
-    "slab": "Slab",
-    "productboard": "Productboard",
-    "file": "File",
-    "coda": "Coda",
-    "notion": "Notion",
-    "zulip": "Zulip",
-    "linear": "Linear",
-    "hubspot": "HubSpot",
-    "document360": "Document360",
-    "gong": "Gong",
-    "google_sites": "Google Sites",
-    "zendesk": "Zendesk",
-    "loopio": "Loopio",
-    "dropbox": "Dropbox",
-    "sharepoint": "SharePoint",
-    "teams": "Teams",
-    "salesforce": "Salesforce",
-    "discourse": "Discourse",
-    "axero": "Axero",
-    "clickup": "ClickUp",
-    "mediawiki": "MediaWiki",
-    "wikipedia": "Wikipedia",
-    "asana": "Asana",
-    "s3": "S3",
-    "r2": "R2",
-    "google_cloud_storage": "Google Cloud Storage",
-    "oci_storage": "OCI Storage",
-    "xenforo": "XenForo",
-    "not_applicable": "Not Applicable",
-    "discord": "Discord",
-    "freshdesk": "Freshdesk",
-    "fireflies": "Fireflies",
-    "egnyte": "Egnyte",
-    "airtable": "Airtable",
-    "highspot": "Highspot",
-    "drupal_wiki": "Drupal Wiki",
-    "imap": "IMAP",
-    "bitbucket": "Bitbucket",
-    "testrail": "TestRail",
-    "mock_connector": "Mock Connector",
-    "user_file": "User File",
-}
-
-
-def upgrade() -> None:
-    # 1. Create hierarchy_node table
-    op.create_table(
-        "hierarchy_node",
-        sa.Column("id", sa.Integer(), nullable=False),
-        sa.Column("raw_node_id", sa.String(), nullable=False),
-        sa.Column("display_name", sa.String(), nullable=False),
-        sa.Column("link", sa.String(), nullable=True),
-        sa.Column("source", sa.String(), nullable=False),
-        sa.Column("node_type", sa.String(), nullable=False),
-        sa.Column("document_id", sa.String(), nullable=True),
-        sa.Column("parent_id", sa.Integer(), nullable=True),
-        # Permission fields - same pattern as Document table
-        sa.Column(
-            "external_user_emails",
-            postgresql.ARRAY(sa.String()),
-            nullable=True,
-        ),
-        sa.Column(
-            "external_user_group_ids",
-            postgresql.ARRAY(sa.String()),
-            nullable=True,
-        ),
-        sa.Column("is_public", sa.Boolean(), nullable=False, server_default="false"),
-        sa.PrimaryKeyConstraint("id"),
-        # When document is deleted, just unlink (node can exist without document)
-        sa.ForeignKeyConstraint(["document_id"], ["document.id"], ondelete="SET NULL"),
-        # When parent node is deleted, orphan children (cleanup via pruning)
-        sa.ForeignKeyConstraint(
-            ["parent_id"], ["hierarchy_node.id"], ondelete="SET NULL"
-        ),
-        sa.UniqueConstraint(
-            "raw_node_id", "source", name="uq_hierarchy_node_raw_id_source"
-        ),
-    )
-    op.create_index("ix_hierarchy_node_parent_id", "hierarchy_node", ["parent_id"])
-    op.create_index(
-        "ix_hierarchy_node_source_type", "hierarchy_node", ["source", "node_type"]
-    )
-
-    # Add partial unique index to ensure only one SOURCE-type node per source
-    # This prevents duplicate source root nodes from being created
-    # NOTE: node_type stores enum NAME ('SOURCE'), not value ('source')
-    op.execute(
-        sa.text(
-            """
-            CREATE UNIQUE INDEX uq_hierarchy_node_one_source_per_type
-            ON hierarchy_node (source)
-            WHERE node_type = 'SOURCE'
-            """
-        )
-    )
-
-    # 2. Create hierarchy_fetch_attempt table
-    op.create_table(
-        "hierarchy_fetch_attempt",
-        sa.Column("id", postgresql.UUID(as_uuid=True), nullable=False),
-        sa.Column("connector_credential_pair_id", sa.Integer(), nullable=False),
-        sa.Column("status", sa.String(), nullable=False),
-        sa.Column("nodes_fetched", sa.Integer(), nullable=True, server_default="0"),
-        sa.Column("nodes_updated", sa.Integer(), nullable=True, server_default="0"),
-        sa.Column("error_msg", sa.Text(), nullable=True),
-        sa.Column("full_exception_trace", sa.Text(), nullable=True),
-        sa.Column(
-            "time_created",
-            sa.DateTime(timezone=True),
-            server_default=sa.func.now(),
-            nullable=False,
-        ),
-        sa.Column("time_started", sa.DateTime(timezone=True), nullable=True),
-        sa.Column(
-            "time_updated",
-            sa.DateTime(timezone=True),
-            server_default=sa.func.now(),
-            nullable=False,
-        ),
-        sa.PrimaryKeyConstraint("id"),
-        sa.ForeignKeyConstraint(
-            ["connector_credential_pair_id"],
-            ["connector_credential_pair.id"],
-            ondelete="CASCADE",
-        ),
-    )
-    op.create_index(
-        "ix_hierarchy_fetch_attempt_status", "hierarchy_fetch_attempt", ["status"]
-    )
-    op.create_index(
-        "ix_hierarchy_fetch_attempt_time_created",
-        "hierarchy_fetch_attempt",
-        ["time_created"],
-    )
-    op.create_index(
-        "ix_hierarchy_fetch_attempt_cc_pair",
-        "hierarchy_fetch_attempt",
-        ["connector_credential_pair_id"],
-    )
-
-    # 3. Insert SOURCE-type hierarchy nodes for each DocumentSource
-    # We insert these so every existing document can have a parent hierarchy node
-    # NOTE: SQLAlchemy's Enum with native_enum=False stores the enum NAME (e.g., 'GOOGLE_DRIVE'),
-    # not the VALUE (e.g., 'google_drive'). We must use .name for source and node_type columns.
-    # SOURCE nodes are always public since they're just categorical roots.
-    for source in DocumentSource:
-        source_name = (
-            source.name
-        )  # e.g., 'GOOGLE_DRIVE' - what SQLAlchemy stores/expects
-        source_value = source.value  # e.g., 'google_drive' - the raw_node_id
-        display_name = SOURCE_DISPLAY_NAMES.get(
-            source_value, source_value.replace("_", " ").title()
-        )
-        op.execute(
-            sa.text(
-                """
-                INSERT INTO hierarchy_node (raw_node_id, display_name, source, node_type, parent_id, is_public)
-                VALUES (:raw_node_id, :display_name, :source, 'SOURCE', NULL, true)
-                ON CONFLICT (raw_node_id, source) DO NOTHING
-                """
-            ).bindparams(
-                raw_node_id=source_value,  # Use .value for raw_node_id (human-readable identifier)
-                display_name=display_name,
-                source=source_name,  # Use .name for source column (SQLAlchemy enum storage)
-            )
-        )
-
-    # 4. Add parent_hierarchy_node_id column to document table
-    op.add_column(
-        "document",
-        sa.Column("parent_hierarchy_node_id", sa.Integer(), nullable=True),
-    )
-    # When hierarchy node is deleted, just unlink the document (SET NULL)
-    op.create_foreign_key(
-        "fk_document_parent_hierarchy_node",
-        "document",
-        "hierarchy_node",
-        ["parent_hierarchy_node_id"],
-        ["id"],
-        ondelete="SET NULL",
-    )
-    op.create_index(
-        "ix_document_parent_hierarchy_node_id",
-        "document",
-        ["parent_hierarchy_node_id"],
-    )
-
-    # 5. Set all existing documents' parent_hierarchy_node_id to their source's SOURCE node
-    # For documents with multiple connectors, we pick one source deterministically (MIN connector_id)
-    # NOTE: Both connector.source and hierarchy_node.source store enum NAMEs (e.g., 'GOOGLE_DRIVE')
-    # because SQLAlchemy Enum(native_enum=False) uses the enum name for storage.
-    op.execute(
-        sa.text(
-            """
-            UPDATE document d
-            SET parent_hierarchy_node_id = hn.id
-            FROM (
-                -- Get the source for each document (pick MIN connector_id for determinism)
-                SELECT DISTINCT ON (dbcc.id)
-                    dbcc.id as doc_id,
-                    c.source as source
-                FROM document_by_connector_credential_pair dbcc
-                JOIN connector c ON dbcc.connector_id = c.id
-                ORDER BY dbcc.id, dbcc.connector_id
-            ) doc_source
-            JOIN hierarchy_node hn ON hn.source = doc_source.source AND hn.node_type = 'SOURCE'
-            WHERE d.id = doc_source.doc_id
-            """
-        )
-    )
-
-    # Create the persona__hierarchy_node association table
-    op.create_table(
-        "persona__hierarchy_node",
-        sa.Column("persona_id", sa.Integer(), nullable=False),
-        sa.Column("hierarchy_node_id", sa.Integer(), nullable=False),
-        sa.ForeignKeyConstraint(
-            ["persona_id"],
-            ["persona.id"],
-            ondelete="CASCADE",
-        ),
-        sa.ForeignKeyConstraint(
-            ["hierarchy_node_id"],
-            ["hierarchy_node.id"],
-            ondelete="CASCADE",
-        ),
-        sa.PrimaryKeyConstraint("persona_id", "hierarchy_node_id"),
-    )
-
-    # Add index for efficient lookups
-    op.create_index(
-        "ix_persona__hierarchy_node_hierarchy_node_id",
-        "persona__hierarchy_node",
-        ["hierarchy_node_id"],
-    )
-
-    # Create the persona__document association table for attaching individual
-    # documents directly to assistants
-    op.create_table(
-        "persona__document",
-        sa.Column("persona_id", sa.Integer(), nullable=False),
-        sa.Column("document_id", sa.String(), nullable=False),
-        sa.ForeignKeyConstraint(
-            ["persona_id"],
-            ["persona.id"],
-            ondelete="CASCADE",
-        ),
-        sa.ForeignKeyConstraint(
-            ["document_id"],
-            ["document.id"],
-            ondelete="CASCADE",
-        ),
-        sa.PrimaryKeyConstraint("persona_id", "document_id"),
-    )
-
-    # Add index for efficient lookups by document_id
-    op.create_index(
-        "ix_persona__document_document_id",
-        "persona__document",
-        ["document_id"],
-    )
-
-    # 6. Add last_time_hierarchy_fetch column to connector_credential_pair table
-    op.add_column(
-        "connector_credential_pair",
-        sa.Column(
-            "last_time_hierarchy_fetch", sa.DateTime(timezone=True), nullable=True
-        ),
-    )
-
-
-def downgrade() -> None:
-    # Remove last_time_hierarchy_fetch from connector_credential_pair
-    op.drop_column("connector_credential_pair", "last_time_hierarchy_fetch")
-
-    # Drop persona__document table
-    op.drop_index("ix_persona__document_document_id", table_name="persona__document")
-    op.drop_table("persona__document")
-
-    # Drop persona__hierarchy_node table
-    op.drop_index(
-        "ix_persona__hierarchy_node_hierarchy_node_id",
-        table_name="persona__hierarchy_node",
-    )
-    op.drop_table("persona__hierarchy_node")
-
-    # Remove parent_hierarchy_node_id from document
-    op.drop_index("ix_document_parent_hierarchy_node_id", table_name="document")
-    op.drop_constraint(
-        "fk_document_parent_hierarchy_node", "document", type_="foreignkey"
-    )
-    op.drop_column("document", "parent_hierarchy_node_id")
-
-    # Drop hierarchy_fetch_attempt table
-    op.drop_index(
-        "ix_hierarchy_fetch_attempt_cc_pair", table_name="hierarchy_fetch_attempt"
-    )
-    op.drop_index(
-        "ix_hierarchy_fetch_attempt_time_created", table_name="hierarchy_fetch_attempt"
-    )
-    op.drop_index(
-        "ix_hierarchy_fetch_attempt_status", table_name="hierarchy_fetch_attempt"
-    )
-    op.drop_table("hierarchy_fetch_attempt")
-
-    # Drop hierarchy_node table
-    op.drop_index("uq_hierarchy_node_one_source_per_type", table_name="hierarchy_node")
-    op.drop_index("ix_hierarchy_node_source_type", table_name="hierarchy_node")
-    op.drop_index("ix_hierarchy_node_parent_id", table_name="hierarchy_node")
-    op.drop_table("hierarchy_node")

backend/alembic/versions/849b21c732f8_add_demo_data_enabled_to_build_session.py

@@ -1,32 +0,0 @@
-"""add demo_data_enabled to build_session
-
-Revision ID: 849b21c732f8
-Revises: 81c22b1e2e78
-Create Date: 2026-01-28 10:00:00.000000
-
-"""
-
-from alembic import op
-import sqlalchemy as sa
-
-# revision identifiers, used by Alembic.
-revision = "849b21c732f8"
-down_revision = "81c22b1e2e78"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "build_session",
-        sa.Column(
-            "demo_data_enabled",
-            sa.Boolean(),
-            nullable=False,
-            server_default=sa.text("true"),
-        ),
-    )
-
-
-def downgrade() -> None:
-    op.drop_column("build_session", "demo_data_enabled")

backend/alembic/versions/8b5ce697290e_add_discord_bot_tables.py

@@ -1,116 +0,0 @@
-"""Add Discord bot tables
-
-Revision ID: 8b5ce697290e
-Revises: a1b2c3d4e5f7
-Create Date: 2025-01-14
-
-"""
-
-from alembic import op
-import sqlalchemy as sa
-
-# revision identifiers, used by Alembic.
-revision = "8b5ce697290e"
-down_revision = "a1b2c3d4e5f7"
-branch_labels: None = None
-depends_on: None = None
-
-
-def upgrade() -> None:
-    # DiscordBotConfig (singleton table - one per tenant)
-    op.create_table(
-        "discord_bot_config",
-        sa.Column(
-            "id",
-            sa.String(),
-            primary_key=True,
-            server_default=sa.text("'SINGLETON'"),
-        ),
-        sa.Column("bot_token", sa.LargeBinary(), nullable=False),  # EncryptedString
-        sa.Column(
-            "created_at",
-            sa.DateTime(timezone=True),
-            server_default=sa.func.now(),
-            nullable=False,
-        ),
-        sa.CheckConstraint("id = 'SINGLETON'", name="ck_discord_bot_config_singleton"),
-    )
-
-    # DiscordGuildConfig
-    op.create_table(
-        "discord_guild_config",
-        sa.Column("id", sa.Integer(), primary_key=True),
-        sa.Column("guild_id", sa.BigInteger(), nullable=True, unique=True),
-        sa.Column("guild_name", sa.String(), nullable=True),
-        sa.Column("registration_key", sa.String(), nullable=False, unique=True),
-        sa.Column("registered_at", sa.DateTime(timezone=True), nullable=True),
-        sa.Column(
-            "default_persona_id",
-            sa.Integer(),
-            sa.ForeignKey("persona.id", ondelete="SET NULL"),
-            nullable=True,
-        ),
-        sa.Column(
-            "enabled", sa.Boolean(), server_default=sa.text("true"), nullable=False
-        ),
-    )
-
-    # DiscordChannelConfig
-    op.create_table(
-        "discord_channel_config",
-        sa.Column("id", sa.Integer(), primary_key=True),
-        sa.Column(
-            "guild_config_id",
-            sa.Integer(),
-            sa.ForeignKey("discord_guild_config.id", ondelete="CASCADE"),
-            nullable=False,
-        ),
-        sa.Column("channel_id", sa.BigInteger(), nullable=False),
-        sa.Column("channel_name", sa.String(), nullable=False),
-        sa.Column(
-            "channel_type",
-            sa.String(20),
-            server_default=sa.text("'text'"),
-            nullable=False,
-        ),
-        sa.Column(
-            "is_private",
-            sa.Boolean(),
-            server_default=sa.text("false"),
-            nullable=False,
-        ),
-        sa.Column(
-            "thread_only_mode",
-            sa.Boolean(),
-            server_default=sa.text("false"),
-            nullable=False,
-        ),
-        sa.Column(
-            "require_bot_invocation",
-            sa.Boolean(),
-            server_default=sa.text("true"),
-            nullable=False,
-        ),
-        sa.Column(
-            "persona_override_id",
-            sa.Integer(),
-            sa.ForeignKey("persona.id", ondelete="SET NULL"),
-            nullable=True,
-        ),
-        sa.Column(
-            "enabled", sa.Boolean(), server_default=sa.text("false"), nullable=False
-        ),
-    )
-
-    # Unique constraint: one config per channel per guild
-    op.create_unique_constraint(
-        "uq_discord_channel_guild_channel",
-        "discord_channel_config",
-        ["guild_config_id", "channel_id"],
-    )
-
-
-def downgrade() -> None:
-    op.drop_table("discord_channel_config")
-    op.drop_table("discord_guild_config")
-    op.drop_table("discord_bot_config")

backend/alembic/versions/9d1543a37106_add_processing_duration_seconds_to_chat_.py

@@ -1,27 +0,0 @@
-"""add processing_duration_seconds to chat_message
-
-Revision ID: 9d1543a37106
-Revises: cbc03e08d0f3
-Create Date: 2026-01-21 11:42:18.546188
-
-"""
-
-from alembic import op
-import sqlalchemy as sa
-
-# revision identifiers, used by Alembic.
-revision = "9d1543a37106"
-down_revision = "cbc03e08d0f3"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "chat_message",
-        sa.Column("processing_duration_seconds", sa.Float(), nullable=True),
-    )
-
-
-def downgrade() -> None:
-    op.drop_column("chat_message", "processing_duration_seconds")

backend/alembic/versions/a1b2c3d4e5f7_drop_agent_search_metrics_table.py

@@ -1,47 +0,0 @@
-"""drop agent_search_metrics table
-
-Revision ID: a1b2c3d4e5f7
-Revises: 73e9983e5091
-Create Date: 2026-01-17
-
-"""
-
-from alembic import op
-import sqlalchemy as sa
-from sqlalchemy.dialects import postgresql
-
-# revision identifiers, used by Alembic.
-revision = "a1b2c3d4e5f7"
-down_revision = "73e9983e5091"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.drop_table("agent__search_metrics")
-
-
-def downgrade() -> None:
-    op.create_table(
-        "agent__search_metrics",
-        sa.Column("id", sa.Integer(), nullable=False),
-        sa.Column("user_id", sa.UUID(), nullable=True),
-        sa.Column("persona_id", sa.Integer(), nullable=True),
-        sa.Column("agent_type", sa.String(), nullable=False),
-        sa.Column("start_time", sa.DateTime(timezone=True), nullable=False),
-        sa.Column("base_duration_s", sa.Float(), nullable=False),
-        sa.Column("full_duration_s", sa.Float(), nullable=False),
-        sa.Column("base_metrics", postgresql.JSONB(), nullable=True),
-        sa.Column("refined_metrics", postgresql.JSONB(), nullable=True),
-        sa.Column("all_metrics", postgresql.JSONB(), nullable=True),
-        sa.ForeignKeyConstraint(
-            ["user_id"],
-            ["user.id"],
-            ondelete="CASCADE",
-        ),
-        sa.ForeignKeyConstraint(
-            ["persona_id"],
-            ["persona.id"],
-        ),
-        sa.PrimaryKeyConstraint("id"),
-    )

backend/alembic/versions/be87a654d5af_persona_new_default_model_configuration_.py

@@ -1,40 +0,0 @@
-"""Persona new default model configuration id column
-
-Revision ID: be87a654d5af
-Revises: e7f8a9b0c1d2
-Create Date: 2026-01-30 11:14:17.306275
-
-"""
-
-from alembic import op
-import sqlalchemy as sa
-
-
-# revision identifiers, used by Alembic.
-revision = "be87a654d5af"
-down_revision = "e7f8a9b0c1d2"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "persona",
-        sa.Column("default_model_configuration_id", sa.Integer(), nullable=True),
-    )
-    op.create_foreign_key(
-        "fk_persona_default_model_configuration_id",
-        "persona",
-        "model_configuration",
-        ["default_model_configuration_id"],
-        ["id"],
-        ondelete="SET NULL",
-    )
-
-
-def downgrade() -> None:
-    op.drop_constraint(
-        "fk_persona_default_model_configuration_id", "persona", type_="foreignkey"
-    )
-
-    op.drop_column("persona", "default_model_configuration_id")

backend/alembic/versions/cbc03e08d0f3_add_opensearch_migration_tables.py

@@ -1,128 +0,0 @@
-"""add_opensearch_migration_tables
-
-Revision ID: cbc03e08d0f3
-Revises: be87a654d5af
-Create Date: 2026-01-31 17:00:45.176604
-
-"""
-
-from alembic import op
-import sqlalchemy as sa
-
-
-# revision identifiers, used by Alembic.
-revision = "cbc03e08d0f3"
-down_revision = "be87a654d5af"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    # 1. Create opensearch_document_migration_record table.
-    op.create_table(
-        "opensearch_document_migration_record",
-        sa.Column("document_id", sa.String(), nullable=False),
-        sa.Column("status", sa.String(), nullable=False, server_default="pending"),
-        sa.Column("error_message", sa.Text(), nullable=True),
-        sa.Column("attempts_count", sa.Integer(), nullable=False, server_default="0"),
-        sa.Column("last_attempt_at", sa.DateTime(timezone=True), nullable=True),
-        sa.Column(
-            "created_at",
-            sa.DateTime(timezone=True),
-            server_default=sa.func.now(),
-            nullable=False,
-        ),
-        sa.PrimaryKeyConstraint("document_id"),
-        sa.ForeignKeyConstraint(
-            ["document_id"],
-            ["document.id"],
-            ondelete="CASCADE",
-        ),
-    )
-    # 2. Create indices.
-    op.create_index(
-        "ix_opensearch_document_migration_record_status",
-        "opensearch_document_migration_record",
-        ["status"],
-    )
-    op.create_index(
-        "ix_opensearch_document_migration_record_attempts_count",
-        "opensearch_document_migration_record",
-        ["attempts_count"],
-    )
-    op.create_index(
-        "ix_opensearch_document_migration_record_created_at",
-        "opensearch_document_migration_record",
-        ["created_at"],
-    )
-
-    # 3. Create opensearch_tenant_migration_record table (singleton).
-    op.create_table(
-        "opensearch_tenant_migration_record",
-        sa.Column("id", sa.Integer(), nullable=False),
-        sa.Column(
-            "document_migration_record_table_population_status",
-            sa.String(),
-            nullable=False,
-            server_default="pending",
-        ),
-        sa.Column(
-            "num_times_observed_no_additional_docs_to_populate_migration_table",
-            sa.Integer(),
-            nullable=False,
-            server_default="0",
-        ),
-        sa.Column(
-            "overall_document_migration_status",
-            sa.String(),
-            nullable=False,
-            server_default="pending",
-        ),
-        sa.Column(
-            "num_times_observed_no_additional_docs_to_migrate",
-            sa.Integer(),
-            nullable=False,
-            server_default="0",
-        ),
-        sa.Column(
-            "last_updated_at",
-            sa.DateTime(timezone=True),
-            server_default=sa.func.now(),
-            nullable=False,
-        ),
-        sa.PrimaryKeyConstraint("id"),
-    )
-
-    # 4. Create unique index on constant to enforce singleton pattern.
-    op.execute(
-        sa.text(
-            """
-            CREATE UNIQUE INDEX idx_opensearch_tenant_migration_singleton
-            ON opensearch_tenant_migration_record ((true))
-            """
-        )
-    )
-
-
-def downgrade() -> None:
-    # Drop opensearch_tenant_migration_record.
-    op.drop_index(
-        "idx_opensearch_tenant_migration_singleton",
-        table_name="opensearch_tenant_migration_record",
-    )
-    op.drop_table("opensearch_tenant_migration_record")
-
-    # Drop opensearch_document_migration_record.
-    op.drop_index(
-        "ix_opensearch_document_migration_record_created_at",
-        table_name="opensearch_document_migration_record",
-    )
-    op.drop_index(
-        "ix_opensearch_document_migration_record_attempts_count",
-        table_name="opensearch_document_migration_record",
-    )
-    op.drop_index(
-        "ix_opensearch_document_migration_record_status",
-        table_name="opensearch_document_migration_record",
-    )
-    op.drop_table("opensearch_document_migration_record")

backend/alembic/versions/e7f8a9b0c1d2_create_anonymous_user.py

@@ -1,125 +0,0 @@
-"""create_anonymous_user
-
-This migration creates a permanent anonymous user in the database.
-When anonymous access is enabled, unauthenticated requests will use this user
-instead of returning user_id=NULL.
-
-Revision ID: e7f8a9b0c1d2
-Revises: f7ca3e2f45d9
-Create Date: 2026-01-15 14:00:00.000000
-
-"""
-
-from alembic import op
-import sqlalchemy as sa
-
-
-# revision identifiers, used by Alembic.
-revision = "e7f8a9b0c1d2"
-down_revision = "f7ca3e2f45d9"
-branch_labels = None
-depends_on = None
-
-# Must match constants in onyx/configs/constants.py file
-ANONYMOUS_USER_UUID = "00000000-0000-0000-0000-000000000002"
-ANONYMOUS_USER_EMAIL = "anonymous@onyx.app"
-
-# Tables with user_id foreign key that may need migration
-TABLES_WITH_USER_ID = [
-    "chat_session",
-    "credential",
-    "document_set",
-    "persona",
-    "tool",
-    "notification",
-    "inputprompt",
-]
-
-
-def upgrade() -> None:
-    """
-    Create the anonymous user for anonymous access feature.
-    Also migrates any remaining user_id=NULL records to the anonymous user.
-    """
-    connection = op.get_bind()
-
-    # Create the anonymous user (using ON CONFLICT to be idempotent)
-    connection.execute(
-        sa.text(
-            """
-            INSERT INTO "user" (id, email, hashed_password, is_active, is_superuser, is_verified, role)
-            VALUES (:id, :email, :hashed_password, :is_active, :is_superuser, :is_verified, :role)
-            ON CONFLICT (id) DO NOTHING
-            """
-        ),
-        {
-            "id": ANONYMOUS_USER_UUID,
-            "email": ANONYMOUS_USER_EMAIL,
-            "hashed_password": "",  # Empty password - user cannot log in directly
-            "is_active": True,  # Active so it can be used for anonymous access
-            "is_superuser": False,
-            "is_verified": True,  # Verified since no email verification needed
-            "role": "LIMITED",  # Anonymous users have limited role to restrict access
-        },
-    )
-
-    # Migrate any remaining user_id=NULL records to anonymous user
-    for table in TABLES_WITH_USER_ID:
-        try:
-            # Exclude public credential (id=0) which must remain user_id=NULL
-            # Exclude builtin tools (in_code_tool_id IS NOT NULL) which must remain user_id=NULL
-            # Exclude builtin personas (builtin_persona=True) which must remain user_id=NULL
-            # Exclude system input prompts (is_public=True with user_id=NULL) which must remain user_id=NULL
-            if table == "credential":
-                condition = "user_id IS NULL AND id != 0"
-            elif table == "tool":
-                condition = "user_id IS NULL AND in_code_tool_id IS NULL"
-            elif table == "persona":
-                condition = "user_id IS NULL AND builtin_persona = false"
-            elif table == "inputprompt":
-                condition = "user_id IS NULL AND is_public = false"
-            else:
-                condition = "user_id IS NULL"
-            result = connection.execute(
-                sa.text(
-                    f"""
-                    UPDATE "{table}"
-                    SET user_id = :user_id
-                    WHERE {condition}
-                    """
-                ),
-                {"user_id": ANONYMOUS_USER_UUID},
-            )
-            if result.rowcount > 0:
-                print(f"Updated {result.rowcount} rows in {table} to anonymous user")
-        except Exception as e:
-            print(f"Skipping {table}: {e}")
-
-
-def downgrade() -> None:
-    """
-    Set anonymous user's records back to NULL and delete the anonymous user.
-    """
-    connection = op.get_bind()
-
-    # Set records back to NULL
-    for table in TABLES_WITH_USER_ID:
-        try:
-            connection.execute(
-                sa.text(
-                    f"""
-                    UPDATE "{table}"
-                    SET user_id = NULL
-                    WHERE user_id = :user_id
-                    """
-                ),
-                {"user_id": ANONYMOUS_USER_UUID},
-            )
-        except Exception:
-            pass
-
-    # Delete the anonymous user
-    connection.execute(
-        sa.text('DELETE FROM "user" WHERE id = :user_id'),
-        {"user_id": ANONYMOUS_USER_UUID},
-    )

backend/alembic/versions/f220515df7b4_add_flow_mapping_table.py

@@ -1,57 +0,0 @@
-"""Add flow mapping table
-
-Revision ID: f220515df7b4
-Revises: cbc03e08d0f3
-Create Date: 2026-01-30 12:21:24.955922
-
-"""
-
-from onyx.db.enums import LLMModelFlowType
-from alembic import op
-import sqlalchemy as sa
-
-
-# revision identifiers, used by Alembic.
-revision = "f220515df7b4"
-down_revision = "9d1543a37106"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.create_table(
-        "llm_model_flow",
-        sa.Column("id", sa.Integer(), nullable=False),
-        sa.Column(
-            "llm_model_flow_type",
-            sa.Enum(LLMModelFlowType, name="llmmodelflowtype", native_enum=False),
-            nullable=False,
-        ),
-        sa.Column(
-            "is_default", sa.Boolean(), nullable=False, server_default=sa.text("false")
-        ),
-        sa.Column("model_configuration_id", sa.Integer(), nullable=False),
-        sa.PrimaryKeyConstraint("id"),
-        sa.ForeignKeyConstraint(
-            ["model_configuration_id"], ["model_configuration.id"], ondelete="CASCADE"
-        ),
-        sa.UniqueConstraint(
-            "llm_model_flow_type",
-            "model_configuration_id",
-            name="uq_model_config_per_llm_model_flow_type",
-        ),
-    )
-
-    # Partial unique index so that there is at most one default for each flow type
-    op.create_index(
-        "ix_one_default_per_llm_model_flow",
-        "llm_model_flow",
-        ["llm_model_flow_type"],
-        unique=True,
-        postgresql_where=sa.text("is_default IS TRUE"),
-    )
-
-
-def downgrade() -> None:
-    # Drop the llm_model_flow table (index is dropped automatically with table)
-    op.drop_table("llm_model_flow")

backend/alembic/versions/f7ca3e2f45d9_migrate_no_auth_data_to_placeholder.py

@@ -1,281 +0,0 @@
-"""migrate_no_auth_data_to_placeholder
-
-This migration handles the transition from AUTH_TYPE=disabled to requiring
-authentication. It creates a placeholder user and assigns all data that was
-created without a user (user_id=NULL) to this placeholder.
-
-A database trigger is installed that automatically transfers all data from
-the placeholder user to the first real user who registers, then drops itself.
-
-Revision ID: f7ca3e2f45d9
-Revises: 78ebc66946a0
-Create Date: 2026-01-15 12:49:53.802741
-
-"""
-
-import os
-
-from alembic import op
-import sqlalchemy as sa
-
-from shared_configs.configs import MULTI_TENANT
-
-
-# revision identifiers, used by Alembic.
-revision = "f7ca3e2f45d9"
-down_revision = "78ebc66946a0"
-branch_labels = None
-depends_on = None
-
-# Must match constants in onyx/configs/constants.py file
-NO_AUTH_PLACEHOLDER_USER_UUID = "00000000-0000-0000-0000-000000000001"
-NO_AUTH_PLACEHOLDER_USER_EMAIL = "no-auth-placeholder@onyx.app"
-
-# Trigger and function names
-TRIGGER_NAME = "trg_migrate_no_auth_data"
-FUNCTION_NAME = "migrate_no_auth_data_to_user"
-
-# Trigger function that migrates data from placeholder to first real user
-MIGRATE_NO_AUTH_TRIGGER_FUNCTION = f"""
-CREATE OR REPLACE FUNCTION {FUNCTION_NAME}()
-RETURNS TRIGGER AS $$
-DECLARE
-    placeholder_uuid UUID := '00000000-0000-0000-0000-000000000001'::uuid;
-    anonymous_uuid UUID := '00000000-0000-0000-0000-000000000002'::uuid;
-    placeholder_row RECORD;
-    schema_name TEXT;
-BEGIN
-    -- Skip if this is the placeholder user being inserted
-    IF NEW.id = placeholder_uuid THEN
-        RETURN NULL;
-    END IF;
-
-    -- Skip if this is the anonymous user being inserted (not a real user)
-    IF NEW.id = anonymous_uuid THEN
-        RETURN NULL;
-    END IF;
-
-    -- Skip if the new user is not active
-    IF NEW.is_active = FALSE THEN
-        RETURN NULL;
-    END IF;
-
-    -- Get current schema for self-cleanup
-    schema_name := current_schema();
-
-    -- Try to lock the placeholder user row with FOR UPDATE SKIP LOCKED
-    -- This ensures only one concurrent transaction can proceed with migration
-    -- SKIP LOCKED means if another transaction has the lock, we skip (don't wait)
-    SELECT id INTO placeholder_row
-    FROM "user"
-    WHERE id = placeholder_uuid
-    FOR UPDATE SKIP LOCKED;
-
-    IF NOT FOUND THEN
-        -- Either placeholder doesn't exist or another transaction has it locked
-        -- Either way, drop the trigger and return without making admin
-        EXECUTE format('DROP TRIGGER IF EXISTS {TRIGGER_NAME} ON %I."user"', schema_name);
-        EXECUTE format('DROP FUNCTION IF EXISTS %I.{FUNCTION_NAME}()', schema_name);
-        RETURN NULL;
-    END IF;
-
-    -- We have exclusive lock on placeholder - proceed with migration
-    -- The INSERT has already completed (AFTER INSERT), so NEW.id exists in the table
-
-    -- Migrate chat_session
-    UPDATE "chat_session" SET user_id = NEW.id WHERE user_id = placeholder_uuid;
-
-    -- Migrate credential (exclude public credential id=0)
-    UPDATE "credential" SET user_id = NEW.id WHERE user_id = placeholder_uuid AND id != 0;
-
-    -- Migrate document_set
-    UPDATE "document_set" SET user_id = NEW.id WHERE user_id = placeholder_uuid;
-
-    -- Migrate persona (exclude builtin personas)
-    UPDATE "persona" SET user_id = NEW.id WHERE user_id = placeholder_uuid AND builtin_persona = FALSE;
-
-    -- Migrate tool (exclude builtin tools)
-    UPDATE "tool" SET user_id = NEW.id WHERE user_id = placeholder_uuid AND in_code_tool_id IS NULL;
-
-    -- Migrate notification
-    UPDATE "notification" SET user_id = NEW.id WHERE user_id = placeholder_uuid;
-
-    -- Migrate inputprompt (exclude system/public prompts)
-    UPDATE "inputprompt" SET user_id = NEW.id WHERE user_id = placeholder_uuid AND is_public = FALSE;
-
-    -- Make the new user an admin (they had admin access in no-auth mode)
-    -- In AFTER INSERT trigger, we must UPDATE the row since it already exists
-    UPDATE "user" SET role = 'ADMIN' WHERE id = NEW.id;
-
-    -- Delete the placeholder user (we hold the lock so this is safe)
-    DELETE FROM "user" WHERE id = placeholder_uuid;
-
-    -- Drop the trigger and function (self-cleanup)
-    EXECUTE format('DROP TRIGGER IF EXISTS {TRIGGER_NAME} ON %I."user"', schema_name);
-    EXECUTE format('DROP FUNCTION IF EXISTS %I.{FUNCTION_NAME}()', schema_name);
-
-    RETURN NULL;
-END;
-$$ LANGUAGE plpgsql;
-"""
-
-MIGRATE_NO_AUTH_TRIGGER = f"""
-CREATE TRIGGER {TRIGGER_NAME}
-AFTER INSERT ON "user"
-FOR EACH ROW
-EXECUTE FUNCTION {FUNCTION_NAME}();
-"""
-
-
-def upgrade() -> None:
-    """
-    Create a placeholder user and assign all NULL user_id records to it.
-    Install a trigger that migrates data to the first real user and self-destructs.
-    Only runs if AUTH_TYPE is currently disabled/none.
-
-    Skipped in multi-tenant mode - each tenant starts fresh with no legacy data.
-    """
-    # Skip in multi-tenant mode - this migration handles single-tenant
-    # AUTH_TYPE=disabled -> auth transitions only
-    if MULTI_TENANT:
-        return
-
-    # Only run if AUTH_TYPE is currently disabled/none
-    # If they've already switched to auth-enabled, NULL data is stale anyway
-    auth_type = (os.environ.get("AUTH_TYPE") or "").lower()
-    if auth_type not in ("disabled", "none", ""):
-        print(f"AUTH_TYPE is '{auth_type}', not disabled. Skipping migration.")
-        return
-
-    connection = op.get_bind()
-
-    # Check if there are any NULL user_id records that need migration
-    tables_to_check = [
-        "chat_session",
-        "credential",
-        "document_set",
-        "persona",
-        "tool",
-        "notification",
-        "inputprompt",
-    ]
-
-    has_null_records = False
-    for table in tables_to_check:
-        try:
-            result = connection.execute(
-                sa.text(f'SELECT 1 FROM "{table}" WHERE user_id IS NULL LIMIT 1')
-            )
-            if result.fetchone():
-                has_null_records = True
-                break
-        except Exception:
-            # Table might not exist
-            pass
-
-    if not has_null_records:
-        return
-
-    # Create the placeholder user
-    connection.execute(
-        sa.text(
-            """
-            INSERT INTO "user" (id, email, hashed_password, is_active, is_superuser, is_verified, role)
-            VALUES (:id, :email, :hashed_password, :is_active, :is_superuser, :is_verified, :role)
-            """
-        ),
-        {
-            "id": NO_AUTH_PLACEHOLDER_USER_UUID,
-            "email": NO_AUTH_PLACEHOLDER_USER_EMAIL,
-            "hashed_password": "",  # Empty password - user cannot log in
-            "is_active": False,  # Inactive - user cannot log in
-            "is_superuser": False,
-            "is_verified": False,
-            "role": "BASIC",
-        },
-    )
-
-    # Assign NULL user_id records to the placeholder user
-    for table in tables_to_check:
-        try:
-            # Base condition for all tables
-            condition = "user_id IS NULL"
-            # Exclude public credential (id=0) which must remain user_id=NULL
-            if table == "credential":
-                condition += " AND id != 0"
-            # Exclude builtin tools (in_code_tool_id IS NOT NULL) which must remain user_id=NULL
-            elif table == "tool":
-                condition += " AND in_code_tool_id IS NULL"
-            # Exclude builtin personas which must remain user_id=NULL
-            elif table == "persona":
-                condition += " AND builtin_persona = FALSE"
-            # Exclude system/public input prompts which must remain user_id=NULL
-            elif table == "inputprompt":
-                condition += " AND is_public = FALSE"
-            result = connection.execute(
-                sa.text(
-                    f"""
-                    UPDATE "{table}"
-                    SET user_id = :user_id
-                    WHERE {condition}
-                    """
-                ),
-                {"user_id": NO_AUTH_PLACEHOLDER_USER_UUID},
-            )
-            if result.rowcount > 0:
-                print(f"Updated {result.rowcount} rows in {table}")
-        except Exception as e:
-            print(f"Skipping {table}: {e}")
-
-    # Install the trigger function and trigger for automatic migration on first user registration
-    connection.execute(sa.text(MIGRATE_NO_AUTH_TRIGGER_FUNCTION))
-    connection.execute(sa.text(MIGRATE_NO_AUTH_TRIGGER))
-    print("Installed trigger for automatic data migration on first user registration")
-
-
-def downgrade() -> None:
-    """
-    Drop trigger and function, set placeholder user's records back to NULL,
-    and delete the placeholder user.
-    """
-    # Skip in multi-tenant mode for consistency with upgrade
-    if MULTI_TENANT:
-        return
-
-    connection = op.get_bind()
-
-    # Drop trigger and function if they exist (they may have already self-destructed)
-    connection.execute(sa.text(f'DROP TRIGGER IF EXISTS {TRIGGER_NAME} ON "user"'))
-    connection.execute(sa.text(f"DROP FUNCTION IF EXISTS {FUNCTION_NAME}()"))
-
-    tables_to_update = [
-        "chat_session",
-        "credential",
-        "document_set",
-        "persona",
-        "tool",
-        "notification",
-        "inputprompt",
-    ]
-
-    # Set records back to NULL
-    for table in tables_to_update:
-        try:
-            connection.execute(
-                sa.text(
-                    f"""
-                    UPDATE "{table}"
-                    SET user_id = NULL
-                    WHERE user_id = :user_id
-                    """
-                ),
-                {"user_id": NO_AUTH_PLACEHOLDER_USER_UUID},
-            )
-        except Exception:
-            pass
-
-    # Delete the placeholder user
-    connection.execute(
-        sa.text('DELETE FROM "user" WHERE id = :user_id'),
-        {"user_id": NO_AUTH_PLACEHOLDER_USER_UUID},
-    )

backend/alembic/versions/fb80bdd256de_add_chat_background_to_user.py

@@ -1,31 +0,0 @@
-"""add chat_background to user
-
-Revision ID: fb80bdd256de
-Revises: 8b5ce697290e
-Create Date: 2026-01-16 16:15:59.222617
-
-"""
-
-from alembic import op
-import sqlalchemy as sa
-
-# revision identifiers, used by Alembic.
-revision = "fb80bdd256de"
-down_revision = "8b5ce697290e"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "user",
-        sa.Column(
-            "chat_background",
-            sa.String(),
-            nullable=True,
-        ),
-    )
-
-
-def downgrade() -> None:
-    op.drop_column("user", "chat_background")

backend/ee/onyx/access/access.py

@@ -116,7 +116,7 @@ def _get_access_for_documents(
     return access_map
 
 
-def _get_acl_for_user(user: User, db_session: Session) -> set[str]:
+def _get_acl_for_user(user: User | None, db_session: Session) -> set[str]:
     """Returns a list of ACL entries that the user has access to. This is meant to be
     used downstream to filter out documents that the user does not have access to. The
     user should have access to a document if at least one entry in the document's ACL
@@ -124,16 +124,13 @@ def _get_acl_for_user(user: User, db_session: Session) -> set[str]:
 
     NOTE: is imported in onyx.access.access by `fetch_versioned_implementation`
     DO NOT REMOVE."""
-    is_anonymous = user.is_anonymous
-    db_user_groups = (
-        [] if is_anonymous else fetch_user_groups_for_user(db_session, user.id)
-    )
+    db_user_groups = fetch_user_groups_for_user(db_session, user.id) if user else []
     prefixed_user_groups = [
         prefix_user_group(db_user_group.name) for db_user_group in db_user_groups
     ]
 
     db_external_groups = (
-        [] if is_anonymous else fetch_external_groups_for_user(db_session, user.id)
+        fetch_external_groups_for_user(db_session, user.id) if user else []
     )
     prefixed_external_groups = [
         prefix_external_group(db_external_group.external_user_group_id)

backend/ee/onyx/access/hierarchy_access.py

@@ -1,11 +0,0 @@
-from sqlalchemy.orm import Session
-
-from ee.onyx.db.external_perm import fetch_external_groups_for_user
-from onyx.db.models import User
-
-
-def _get_user_external_group_ids(db_session: Session, user: User) -> list[str]:
-    if not user:
-        return []
-    external_groups = fetch_external_groups_for_user(db_session, user.id)
-    return [external_group.external_user_group_id for external_group in external_groups]

backend/ee/onyx/auth/users.py

@@ -33,8 +33,8 @@ def get_default_admin_user_emails_() -> list[str]:
 
 async def current_cloud_superuser(
     request: Request,
-    user: User = Depends(current_admin_user),
-) -> User:
+    user: User | None = Depends(current_admin_user),
+) -> User | None:
     api_key = request.headers.get("Authorization", "").replace("Bearer ", "")
     if api_key != SUPER_CLOUD_API_KEY:
         raise HTTPException(status_code=401, detail="Invalid API key")

backend/ee/onyx/background/celery/tasks/doc_permission_syncing/tasks.py

@@ -25,7 +25,6 @@ from ee.onyx.db.connector_credential_pair import get_all_auto_sync_cc_pairs
 from ee.onyx.db.document import upsert_document_external_perms
 from ee.onyx.external_permissions.sync_params import get_source_perm_sync_config
 from onyx.access.models import DocExternalAccess
-from onyx.access.models import ElementExternalAccess
 from onyx.background.celery.apps.app_base import task_logger
 from onyx.background.celery.celery_redis import celery_find_task
 from onyx.background.celery.celery_redis import celery_get_queue_length
@@ -56,9 +55,6 @@ from onyx.db.enums import AccessType
 from onyx.db.enums import ConnectorCredentialPairStatus
 from onyx.db.enums import SyncStatus
 from onyx.db.enums import SyncType
-from onyx.db.hierarchy import (
-    update_hierarchy_node_permissions as db_update_hierarchy_node_permissions,
-)
 from onyx.db.models import ConnectorCredentialPair
 from onyx.db.permission_sync_attempt import complete_doc_permission_sync_attempt
 from onyx.db.permission_sync_attempt import create_doc_permission_sync_attempt
@@ -641,24 +637,17 @@ def connector_permission_sync_generator_task(
     ),
     stop=stop_after_delay(DOCUMENT_PERMISSIONS_UPDATE_STOP_AFTER),
 )
-def element_update_permissions(
+def document_update_permissions(
     tenant_id: str,
-    permissions: ElementExternalAccess,
+    permissions: DocExternalAccess,
     source_type_str: str,
     connector_id: int,
     credential_id: int,
 ) -> bool:
-    """Update permissions for a document or hierarchy node."""
     start = time.monotonic()
-    external_access = permissions.external_access
 
-    # Determine element type and identifier for logging
-    if isinstance(permissions, DocExternalAccess):
-        element_id = permissions.doc_id
-        element_type = "doc"
-    else:
-        element_id = permissions.raw_node_id
-        element_type = "node"
+    doc_id = permissions.doc_id
+    external_access = permissions.external_access
 
     try:
         with get_session_with_tenant(tenant_id=tenant_id) as db_session:
@@ -668,57 +657,39 @@ def element_update_permissions(
                 emails=list(external_access.external_user_emails),
                 continue_on_error=True,
             )
+            # Then upsert the document's external permissions
+            created_new_doc = upsert_document_external_perms(
+                db_session=db_session,
+                doc_id=doc_id,
+                external_access=external_access,
+                source_type=DocumentSource(source_type_str),
+            )
 
-            if isinstance(permissions, DocExternalAccess):
-                # Document permission update
-                created_new_doc = upsert_document_external_perms(
+            if created_new_doc:
+                # If a new document was created, we associate it with the cc_pair
+                upsert_document_by_connector_credential_pair(
                     db_session=db_session,
-                    doc_id=permissions.doc_id,
-                    external_access=external_access,
-                    source_type=DocumentSource(source_type_str),
-                )
-
-                if created_new_doc:
-                    # If a new document was created, we associate it with the cc_pair
-                    upsert_document_by_connector_credential_pair(
-                        db_session=db_session,
-                        connector_id=connector_id,
-                        credential_id=credential_id,
-                        document_ids=[permissions.doc_id],
-                    )
-            else:
-                # Hierarchy node permission update
-                db_update_hierarchy_node_permissions(
-                    db_session=db_session,
-                    raw_node_id=permissions.raw_node_id,
-                    source=DocumentSource(permissions.source),
-                    is_public=external_access.is_public,
-                    external_user_emails=(
-                        list(external_access.external_user_emails)
-                        if external_access.external_user_emails
-                        else None
-                    ),
-                    external_user_group_ids=(
-                        list(external_access.external_user_group_ids)
-                        if external_access.external_user_group_ids
-                        else None
-                    ),
+                    connector_id=connector_id,
+                    credential_id=credential_id,
+                    document_ids=[doc_id],
                 )
 
             elapsed = time.monotonic() - start
             task_logger.info(
-                f"{element_type}={element_id} "
+                f"connector_id={connector_id} "
+                f"doc={doc_id} "
                 f"action=update_permissions "
                 f"elapsed={elapsed:.2f}"
             )
     except Exception as e:
         task_logger.exception(
-            f"element_update_permissions exceptioned: {element_type}={element_id}, {connector_id=} {credential_id=}"
+            f"document_update_permissions exceptioned: "
+            f"connector_id={connector_id} doc_id={doc_id}"
         )
         raise e
     finally:
         task_logger.info(
-            f"element_update_permissions completed: {element_type}={element_id}, {connector_id=} {credential_id=}"
+            f"document_update_permissions completed: connector_id={connector_id} doc={doc_id}"
         )
 
     return True

backend/ee/onyx/configs/app_configs.py

@@ -122,23 +122,9 @@ SUPER_CLOUD_API_KEY = os.environ.get("SUPER_CLOUD_API_KEY", "api_key")
 # when the capture is called. These defaults prevent Posthog issues from breaking the Onyx app
 POSTHOG_API_KEY = os.environ.get("POSTHOG_API_KEY") or "FooBar"
 POSTHOG_HOST = os.environ.get("POSTHOG_HOST") or "https://us.i.posthog.com"
-POSTHOG_DEBUG_LOGS_ENABLED = (
-    os.environ.get("POSTHOG_DEBUG_LOGS_ENABLED", "").lower() == "true"
-)
 
 MARKETING_POSTHOG_API_KEY = os.environ.get("MARKETING_POSTHOG_API_KEY")
 
 HUBSPOT_TRACKING_URL = os.environ.get("HUBSPOT_TRACKING_URL")
 
 GATED_TENANTS_KEY = "gated_tenants"
-
-# License enforcement - when True, blocks API access for gated/expired licenses
-LICENSE_ENFORCEMENT_ENABLED = (
-    os.environ.get("LICENSE_ENFORCEMENT_ENABLED", "").lower() == "true"
-)
-
-# Cloud data plane URL - self-hosted instances call this to reach cloud proxy endpoints
-# Used when MULTI_TENANT=false (self-hosted mode)
-CLOUD_DATA_PLANE_URL = os.environ.get(
-    "CLOUD_DATA_PLANE_URL", "https://cloud.onyx.app/api"
-)

backend/ee/onyx/configs/license_enforcement_config.py

@@ -1,73 +0,0 @@
-"""Constants for license enforcement.
-
-This file is the single source of truth for:
-1. Paths that bypass license enforcement (always accessible)
-2. Paths that require an EE license (EE-only features)
-
-Import these constants in both production code and tests to ensure consistency.
-"""
-
-# Paths that are ALWAYS accessible, even when license is expired/gated.
-# These enable users to:
-#   /auth - Log in/out (users can't fix billing if locked out of auth)
-#   /license - Fetch, upload, or check license status
-#   /health - Health checks for load balancers/orchestrators
-#   /me - Basic user info needed for UI rendering
-#   /settings, /enterprise-settings - View app status and branding
-#   /billing - Unified billing API
-#   /proxy - Self-hosted proxy endpoints (have own license-based auth)
-#   /tenants/billing-* - Legacy billing endpoints (backwards compatibility)
-#   /manage/users, /users - User management (needed for seat limit resolution)
-#   /notifications - Needed for UI to load properly
-LICENSE_ENFORCEMENT_ALLOWED_PREFIXES: frozenset[str] = frozenset(
-    {
-        "/auth",
-        "/license",
-        "/health",
-        "/me",
-        "/settings",
-        "/enterprise-settings",
-        # Billing endpoints (unified API for both MT and self-hosted)
-        "/billing",
-        "/admin/billing",
-        # Proxy endpoints for self-hosted billing (no tenant context)
-        "/proxy",
-        # Legacy tenant billing endpoints (kept for backwards compatibility)
-        "/tenants/billing-information",
-        "/tenants/create-customer-portal-session",
-        "/tenants/create-subscription-session",
-        # User management - needed to remove users when seat limit exceeded
-        "/manage/users",
-        "/manage/admin/users",
-        "/manage/admin/valid-domains",
-        "/manage/admin/deactivate-user",
-        "/manage/admin/delete-user",
-        "/users",
-        # Notifications - needed for UI to load properly
-        "/notifications",
-    }
-)
-
-# EE-only paths that require a valid license.
-# Users without a license (community edition) cannot access these.
-# These are blocked even when user has never subscribed (no license).
-EE_ONLY_PATH_PREFIXES: frozenset[str] = frozenset(
-    {
-        # User groups and access control
-        "/manage/admin/user-group",
-        # Analytics and reporting
-        "/analytics",
-        # Query history (admin chat session endpoints)
-        "/admin/chat-sessions",
-        "/admin/chat-session-history",
-        "/admin/query-history",
-        # Usage reporting/export
-        "/admin/usage-report",
-        # Standard answers (canned responses)
-        "/manage/admin/standard-answer",
-        # Token rate limits
-        "/admin/token-rate-limits",
-        # Evals
-        "/evals",
-    }
-)

backend/ee/onyx/db/analytics.py

@@ -334,9 +334,11 @@ def fetch_assistant_unique_users_total(
 # Users can view assistant stats if they created the persona,
 # or if they are an admin
 def user_can_view_assistant_stats(
-    db_session: Session, user: User, assistant_id: int
+    db_session: Session, user: User | None, assistant_id: int
 ) -> bool:
-    if user.role == UserRole.ADMIN:
+    # If user is None and auth is disabled, assume the user is an admin
+
+    if user is None or user.role == UserRole.ADMIN:
         return True
 
     # Check if the user created the persona

backend/ee/onyx/db/hierarchy.py

@@ -1,67 +0,0 @@
-"""EE version of hierarchy node access control.
-
-This module provides permission-aware hierarchy node access for Enterprise Edition.
-It filters hierarchy nodes based on user email and external group membership.
-"""
-
-from sqlalchemy import any_
-from sqlalchemy import or_
-from sqlalchemy import select
-from sqlalchemy.dialects import postgresql
-from sqlalchemy.orm import Session
-from sqlalchemy.sql.elements import ColumnElement
-
-from onyx.configs.constants import DocumentSource
-from onyx.db.models import HierarchyNode
-
-
-def _build_hierarchy_access_filter(
-    user_email: str | None,
-    external_group_ids: list[str],
-) -> ColumnElement[bool]:
-    """Build SQLAlchemy filter for hierarchy node access.
-
-    A user can access a hierarchy node if any of the following are true:
-    - The node is marked as public (is_public=True)
-    - The user's email is in the node's external_user_emails list
-    - Any of the user's external group IDs overlap with the node's external_user_group_ids
-    """
-    access_filters: list[ColumnElement[bool]] = [HierarchyNode.is_public.is_(True)]
-    if user_email:
-        access_filters.append(any_(HierarchyNode.external_user_emails) == user_email)
-    if external_group_ids:
-        access_filters.append(
-            HierarchyNode.external_user_group_ids.overlap(
-                postgresql.array(external_group_ids)
-            )
-        )
-    return or_(*access_filters)
-
-
-def _get_accessible_hierarchy_nodes_for_source(
-    db_session: Session,
-    source: DocumentSource,
-    user_email: str | None,
-    external_group_ids: list[str],
-) -> list[HierarchyNode]:
-    """
-    EE version: Returns hierarchy nodes filtered by user permissions.
-
-    A user can access a hierarchy node if any of the following are true:
-    - The node is marked as public (is_public=True)
-    - The user's email is in the node's external_user_emails list
-    - Any of the user's external group IDs overlap with the node's external_user_group_ids
-
-    Args:
-        db_session: SQLAlchemy session
-        source: Document source type
-        user_email: User's email for permission checking
-        external_group_ids: User's external group IDs for permission checking
-
-    Returns:
-        List of HierarchyNode objects the user has access to
-    """
-    stmt = select(HierarchyNode).where(HierarchyNode.source == source)
-    stmt = stmt.where(_build_hierarchy_access_filter(user_email, external_group_ids))
-    stmt = stmt.order_by(HierarchyNode.display_name)
-    return list(db_session.execute(stmt).scalars().all())

backend/ee/onyx/db/license.py

@@ -1,7 +1,6 @@
 """Database and cache operations for the license table."""
 
 from datetime import datetime
-from typing import NamedTuple
 
 from sqlalchemy import func
 from sqlalchemy import select
@@ -10,7 +9,6 @@ from sqlalchemy.orm import Session
 from ee.onyx.server.license.models import LicenseMetadata
 from ee.onyx.server.license.models import LicensePayload
 from ee.onyx.server.license.models import LicenseSource
-from onyx.auth.schemas import UserRole
 from onyx.db.models import License
 from onyx.db.models import User
 from onyx.redis.redis_pool import get_redis_client
@@ -25,13 +23,6 @@ LICENSE_METADATA_KEY = "license:metadata"
 LICENSE_CACHE_TTL_SECONDS = 86400  # 24 hours
 
 
-class SeatAvailabilityResult(NamedTuple):
-    """Result of a seat availability check."""
-
-    available: bool
-    error_message: str | None = None
-
-
 # -----------------------------------------------------------------------------
 # Database CRUD Operations
 # -----------------------------------------------------------------------------
@@ -104,30 +95,23 @@ def delete_license(db_session: Session) -> bool:
 
 def get_used_seats(tenant_id: str | None = None) -> int:
     """
-    Get current seat usage directly from database.
+    Get current seat usage.
 
     For multi-tenant: counts users in UserTenantMapping for this tenant.
-    For self-hosted: counts all active users (excludes EXT_PERM_USER role).
-
-    TODO: Exclude API key dummy users from seat counting. API keys create
-    users with emails like `__DANSWER_API_KEY_*` that should not count toward
-    seat limits. See: https://linear.app/onyx-app/issue/ENG-3518
+    For self-hosted: counts all active users (includes both Onyx UI users
+    and Slack users who have been converted to Onyx users).
     """
     if MULTI_TENANT:
         from ee.onyx.server.tenants.user_mapping import get_tenant_count
 
         return get_tenant_count(tenant_id or get_current_tenant_id())
     else:
+        # Self-hosted: count all active users (Onyx + converted Slack users)
         from onyx.db.engine.sql_engine import get_session_with_current_tenant
 
         with get_session_with_current_tenant() as db_session:
             result = db_session.execute(
-                select(func.count())
-                .select_from(User)
-                .where(
-                    User.is_active == True,  # type: ignore  # noqa: E712
-                    User.role != UserRole.EXT_PERM_USER,
-                )
+                select(func.count()).select_from(User).where(User.is_active)  # type: ignore
             )
             return result.scalar() or 0
 
@@ -227,10 +211,10 @@ def update_license_cache(
         stripe_subscription_id=payload.stripe_subscription_id,
     )
 
-    redis_client.set(
+    redis_client.setex(
         LICENSE_METADATA_KEY,
+        LICENSE_CACHE_TTL_SECONDS,
         metadata.model_dump_json(),
-        ex=LICENSE_CACHE_TTL_SECONDS,
     )
 
     logger.info(f"License cache updated: {metadata.seats} seats, status={status.value}")
@@ -292,43 +276,3 @@ def get_license_metadata(
 
     # Refresh from database
     return refresh_license_cache(db_session, tenant_id)
-
-
-def check_seat_availability(
-    db_session: Session,
-    seats_needed: int = 1,
-    tenant_id: str | None = None,
-) -> SeatAvailabilityResult:
-    """
-    Check if there are enough seats available to add users.
-
-    Args:
-        db_session: Database session
-        seats_needed: Number of seats needed (default 1)
-        tenant_id: Tenant ID (for multi-tenant deployments)
-
-    Returns:
-        SeatAvailabilityResult with available=True if seats are available,
-        or available=False with error_message if limit would be exceeded.
-        Returns available=True if no license exists (self-hosted = unlimited).
-    """
-    metadata = get_license_metadata(db_session, tenant_id)
-
-    # No license = no enforcement (self-hosted without license)
-    if metadata is None:
-        return SeatAvailabilityResult(available=True)
-
-    # Calculate current usage directly from DB (not cache) for accuracy
-    current_used = get_used_seats(tenant_id)
-    total_seats = metadata.seats
-
-    # Use > (not >=) to allow filling to exactly 100% capacity
-    would_exceed_limit = current_used + seats_needed > total_seats
-    if would_exceed_limit:
-        return SeatAvailabilityResult(
-            available=False,
-            error_message=f"Seat limit would be exceeded: {current_used} of {total_seats} seats used, "
-            f"cannot add {seats_needed} more user(s).",
-        )
-
-    return SeatAvailabilityResult(available=True)

backend/ee/onyx/db/search.py

@@ -1,64 +0,0 @@
-import uuid
-from datetime import timedelta
-from uuid import UUID
-
-from sqlalchemy import select
-from sqlalchemy.orm import Session
-
-from onyx.db.engine.time_utils import get_db_current_time
-from onyx.db.models import SearchQuery
-
-
-def create_search_query(
-    db_session: Session,
-    user_id: UUID,
-    query: str,
-    query_expansions: list[str] | None = None,
-) -> SearchQuery:
-    """Create and persist a `SearchQuery` row.
-
-    Notes:
-    - `SearchQuery.id` is a UUID PK without a server-side default, so we generate it.
-    - `created_at` is filled by the DB (server_default=now()).
-    """
-    search_query = SearchQuery(
-        id=uuid.uuid4(),
-        user_id=user_id,
-        query=query,
-        query_expansions=query_expansions,
-    )
-    db_session.add(search_query)
-    db_session.commit()
-    db_session.refresh(search_query)
-    return search_query
-
-
-def fetch_search_queries_for_user(
-    db_session: Session,
-    user_id: UUID,
-    filter_days: int | None = None,
-    limit: int | None = None,
-) -> list[SearchQuery]:
-    """Fetch `SearchQuery` rows for a user.
-
-    Args:
-        user_id: User UUID.
-        filter_days: Optional time filter. If provided, only rows created within
-            the last `filter_days` days are returned.
-        limit: Optional max number of rows to return.
-    """
-    if filter_days is not None and filter_days <= 0:
-        raise ValueError("filter_days must be > 0")
-
-    stmt = select(SearchQuery).where(SearchQuery.user_id == user_id)
-
-    if filter_days is not None and filter_days > 0:
-        cutoff = get_db_current_time(db_session) - timedelta(days=filter_days)
-        stmt = stmt.where(SearchQuery.created_at >= cutoff)
-
-    stmt = stmt.order_by(SearchQuery.created_at.desc())
-
-    if limit is not None:
-        stmt = stmt.limit(limit)
-
-    return list(db_session.scalars(stmt).all())

backend/ee/onyx/db/token_limit.py

@@ -7,6 +7,7 @@ from sqlalchemy import select
 from sqlalchemy.orm import aliased
 from sqlalchemy.orm import Session
 
+from onyx.configs.app_configs import DISABLE_AUTH
 from onyx.configs.constants import TokenRateLimitScope
 from onyx.db.models import TokenRateLimit
 from onyx.db.models import TokenRateLimit__UserGroup
@@ -17,15 +18,13 @@ from onyx.db.models import UserRole
 from onyx.server.token_rate_limits.models import TokenRateLimitArgs
 
 
-def _add_user_filters(stmt: Select, user: User, get_editable: bool = True) -> Select:
-    if user.role == UserRole.ADMIN:
+def _add_user_filters(
+    stmt: Select, user: User | None, get_editable: bool = True
+) -> Select:
+    # If user is None and auth is disabled, assume the user is an admin
+    if (user is None and DISABLE_AUTH) or (user and user.role == UserRole.ADMIN):
         return stmt
 
-    # If anonymous user, only show global/public token_rate_limits
-    if user.is_anonymous:
-        where_clause = TokenRateLimit.scope == TokenRateLimitScope.GLOBAL
-        return stmt.where(where_clause)
-
     stmt = stmt.distinct()
     TRLimit_UG = aliased(TokenRateLimit__UserGroup)
     User__UG = aliased(User__UserGroup)
@@ -50,6 +49,11 @@ def _add_user_filters(stmt: Select, user: User, get_editable: bool = True) -> Se
     - if we are not editing, we show all token_rate_limits in the groups the user curates
     """
 
+    # If user is None, this is an anonymous user and we should only show public token_rate_limits
+    if user is None:
+        where_clause = TokenRateLimit.scope == TokenRateLimitScope.GLOBAL
+        return stmt.where(where_clause)
+
     where_clause = User__UG.user_id == user.id
     if user.role == UserRole.CURATOR and get_editable:
         where_clause &= User__UG.is_curator == True  # noqa: E712
@@ -110,7 +114,7 @@ def insert_user_group_token_rate_limit(
 def fetch_user_group_token_rate_limits_for_user(
     db_session: Session,
     group_id: int,
-    user: User,
+    user: User | None,
     enabled_only: bool = False,
     ordered: bool = True,
     get_editable: bool = True,

backend/ee/onyx/db/user_group.py

@@ -125,7 +125,7 @@ def _cleanup_document_set__user_group_relationships__no_commit(
 
 def validate_object_creation_for_user(
     db_session: Session,
-    user: User,
+    user: User | None,
     target_group_ids: list[int] | None = None,
     object_is_public: bool | None = None,
     object_is_perm_sync: bool | None = None,
@@ -144,8 +144,7 @@ def validate_object_creation_for_user(
     if object_is_perm_sync and not target_group_ids:
         return
 
-    # Admins are allowed
-    if user.role == UserRole.ADMIN:
+    if not user or user.role == UserRole.ADMIN:
         return
 
     # Allow curators and global curators to create public objects
@@ -475,15 +474,14 @@ def remove_curator_status__no_commit(db_session: Session, user: User) -> None:
 def _validate_curator_relationship_update_requester(
     db_session: Session,
     user_group_id: int,
-    user_making_change: User,
+    user_making_change: User | None = None,
 ) -> None:
     """
     This function validates that the user making the change has the necessary permissions
     to update the curator relationship for the target user in the given user group.
     """
 
-    # Admins can update curator relationships for any group
-    if user_making_change.role == UserRole.ADMIN:
+    if user_making_change is None or user_making_change.role == UserRole.ADMIN:
         return
 
     # check if the user making the change is a curator in the group they are changing the curator relationship for
@@ -552,7 +550,7 @@ def update_user_curator_relationship(
     db_session: Session,
     user_group_id: int,
     set_curator_request: SetCuratorRequest,
-    user_making_change: User,
+    user_making_change: User | None = None,
 ) -> None:
     target_user = fetch_user_by_id(db_session, set_curator_request.user_id)
     if not target_user:
@@ -601,7 +599,7 @@ def update_user_curator_relationship(
 
 def add_users_to_user_group(
     db_session: Session,
-    user: User,
+    user: User | None,
     user_group_id: int,
     user_ids: list[UUID],
 ) -> UserGroup:
@@ -643,7 +641,7 @@ def add_users_to_user_group(
 
 def update_user_group(
     db_session: Session,
-    user: User,
+    user: User | None,
     user_group_id: int,
     user_group_update: UserGroupUpdate,
 ) -> UserGroup:

backend/ee/onyx/external_permissions/confluence/doc_sync.py

@@ -8,7 +8,7 @@ from collections.abc import Generator
 from ee.onyx.external_permissions.perm_sync_types import FetchAllDocumentsFunction
 from ee.onyx.external_permissions.perm_sync_types import FetchAllDocumentsIdsFunction
 from ee.onyx.external_permissions.utils import generic_doc_sync
-from onyx.access.models import ElementExternalAccess
+from onyx.access.models import DocExternalAccess
 from onyx.configs.constants import DocumentSource
 from onyx.connectors.confluence.connector import ConfluenceConnector
 from onyx.connectors.credentials_provider import OnyxDBCredentialsProvider
@@ -28,7 +28,7 @@ def confluence_doc_sync(
     fetch_all_existing_docs_fn: FetchAllDocumentsFunction,
     fetch_all_existing_docs_ids_fn: FetchAllDocumentsIdsFunction,
     callback: IndexingHeartbeatInterface | None,
-) -> Generator[ElementExternalAccess, None, None]:
+) -> Generator[DocExternalAccess, None, None]:
     """
     Fetches document permissions from Confluence and yields DocExternalAccess objects.
     Compares fetched documents against existing documents in the DB for the connector.

backend/ee/onyx/external_permissions/gmail/doc_sync.py

@@ -5,12 +5,8 @@ from datetime import timezone
 from ee.onyx.external_permissions.perm_sync_types import FetchAllDocumentsFunction
 from ee.onyx.external_permissions.perm_sync_types import FetchAllDocumentsIdsFunction
 from onyx.access.models import DocExternalAccess
-from onyx.access.models import ElementExternalAccess
-from onyx.access.models import NodeExternalAccess
-from onyx.configs.constants import DocumentSource
 from onyx.connectors.gmail.connector import GmailConnector
 from onyx.connectors.interfaces import GenerateSlimDocumentOutput
-from onyx.connectors.models import HierarchyNode
 from onyx.db.models import ConnectorCredentialPair
 from onyx.indexing.indexing_heartbeat import IndexingHeartbeatInterface
 from onyx.utils.logger import setup_logger
@@ -42,12 +38,12 @@ def gmail_doc_sync(
     fetch_all_existing_docs_fn: FetchAllDocumentsFunction,
     fetch_all_existing_docs_ids_fn: FetchAllDocumentsIdsFunction,
     callback: IndexingHeartbeatInterface | None,
-) -> Generator[ElementExternalAccess, None, None]:
+) -> Generator[DocExternalAccess, None, None]:
     """
-    Adds the external permissions to the documents and hierarchy nodes in postgres.
-    If the document doesn't already exist in postgres, we create
+    Adds the external permissions to the documents in postgres
+    if the document doesn't already exists in postgres, we create
     it in postgres so that when it gets created later, the permissions are
-    already populated.
+    already populated
     """
     gmail_connector = GmailConnector(**cc_pair.connector.connector_specific_config)
     gmail_connector.load_credentials(cc_pair.credential.credential_json)
@@ -64,15 +60,6 @@ def gmail_doc_sync(
 
                 callback.progress("gmail_doc_sync", 1)
 
-            if isinstance(slim_doc, HierarchyNode):
-                # Yield hierarchy node permissions to be processed in outer layer
-                if slim_doc.external_access:
-                    yield NodeExternalAccess(
-                        external_access=slim_doc.external_access,
-                        raw_node_id=slim_doc.raw_node_id,
-                        source=DocumentSource.GMAIL.value,
-                    )
-                continue
             if slim_doc.external_access is None:
                 logger.warning(f"No permissions found for document {slim_doc.id}")
                 continue

backend/ee/onyx/external_permissions/google_drive/doc_sync.py

@@ -10,15 +10,11 @@ from ee.onyx.external_permissions.google_drive.permission_retrieval import (
 from ee.onyx.external_permissions.perm_sync_types import FetchAllDocumentsFunction
 from ee.onyx.external_permissions.perm_sync_types import FetchAllDocumentsIdsFunction
 from onyx.access.models import DocExternalAccess
-from onyx.access.models import ElementExternalAccess
 from onyx.access.models import ExternalAccess
-from onyx.access.models import NodeExternalAccess
-from onyx.configs.constants import DocumentSource
 from onyx.connectors.google_drive.connector import GoogleDriveConnector
 from onyx.connectors.google_drive.models import GoogleDriveFileType
 from onyx.connectors.google_utils.resources import GoogleDriveService
 from onyx.connectors.interfaces import GenerateSlimDocumentOutput
-from onyx.connectors.models import HierarchyNode
 from onyx.db.models import ConnectorCredentialPair
 from onyx.indexing.indexing_heartbeat import IndexingHeartbeatInterface
 from onyx.utils.logger import setup_logger
@@ -171,101 +167,17 @@ def get_external_access_for_raw_gdrive_file(
     )
 
 
-def get_external_access_for_folder(
-    folder: GoogleDriveFileType,
-    google_domain: str,
-    drive_service: GoogleDriveService,
-) -> ExternalAccess:
-    """
-    Extract ExternalAccess from a folder's permissions.
-
-    This fetches permissions using the Drive API (via permissionIds) and extracts
-    user emails, group emails, and public access status.
-
-    Args:
-        folder: The folder metadata from Google Drive API (must include permissionIds field)
-        google_domain: The company's Google Workspace domain (e.g., "company.com")
-        drive_service: Google Drive service for fetching permission details
-
-    Returns:
-        ExternalAccess with extracted permission info
-    """
-    folder_id = folder.get("id")
-    if not folder_id:
-        logger.warning("Folder missing ID, returning empty permissions")
-        return ExternalAccess(
-            external_user_emails=set(),
-            external_user_group_ids=set(),
-            is_public=False,
-        )
-
-    # Get permission IDs from folder metadata
-    permission_ids = folder.get("permissionIds") or []
-    if not permission_ids:
-        logger.debug(f"No permissionIds found for folder {folder_id}")
-        return ExternalAccess(
-            external_user_emails=set(),
-            external_user_group_ids=set(),
-            is_public=False,
-        )
-
-    # Fetch full permission objects using the permission IDs
-    permissions_list = get_permissions_by_ids(
-        drive_service=drive_service,
-        doc_id=folder_id,
-        permission_ids=permission_ids,
-    )
-
-    user_emails: set[str] = set()
-    group_emails: set[str] = set()
-    is_public = False
-
-    for permission in permissions_list:
-        if permission.type == PermissionType.USER:
-            if permission.email_address:
-                user_emails.add(permission.email_address)
-            else:
-                logger.warning(f"User permission without email for folder {folder_id}")
-        elif permission.type == PermissionType.GROUP:
-            # Groups are represented as email addresses in Google Drive
-            if permission.email_address:
-                group_emails.add(permission.email_address)
-            else:
-                logger.warning(f"Group permission without email for folder {folder_id}")
-        elif permission.type == PermissionType.DOMAIN:
-            # Domain permission - check if it matches company domain
-            if permission.domain == google_domain:
-                # Only public if discoverable (allowFileDiscovery is not False)
-                # If allowFileDiscovery is False, it's "link only" access
-                is_public = permission.allow_file_discovery is not False
-            else:
-                logger.debug(
-                    f"Domain permission for {permission.domain} does not match "
-                    f"company domain {google_domain} for folder {folder_id}"
-                )
-        elif permission.type == PermissionType.ANYONE:
-            # Only public if discoverable (allowFileDiscovery is not False)
-            # If allowFileDiscovery is False, it's "link only" access
-            is_public = permission.allow_file_discovery is not False
-
-    return ExternalAccess(
-        external_user_emails=user_emails,
-        external_user_group_ids=group_emails,
-        is_public=is_public,
-    )
-
-
 def gdrive_doc_sync(
     cc_pair: ConnectorCredentialPair,
     fetch_all_existing_docs_fn: FetchAllDocumentsFunction,
     fetch_all_existing_docs_ids_fn: FetchAllDocumentsIdsFunction,
     callback: IndexingHeartbeatInterface | None,
-) -> Generator[ElementExternalAccess, None, None]:
+) -> Generator[DocExternalAccess, None, None]:
     """
-    Adds the external permissions to the documents and hierarchy nodes in postgres.
-    If the document doesn't already exist in postgres, we create
+    Adds the external permissions to the documents in postgres
+    if the document doesn't already exists in postgres, we create
     it in postgres so that when it gets created later, the permissions are
-    already populated.
+    already populated
     """
     google_drive_connector = GoogleDriveConnector(
         **cc_pair.connector.connector_specific_config
@@ -283,15 +195,7 @@ def gdrive_doc_sync(
                     raise RuntimeError("gdrive_doc_sync: Stop signal detected")
 
                 callback.progress("gdrive_doc_sync", 1)
-            if isinstance(slim_doc, HierarchyNode):
-                # Yield hierarchy node permissions to be processed in outer layer
-                if slim_doc.external_access:
-                    yield NodeExternalAccess(
-                        external_access=slim_doc.external_access,
-                        raw_node_id=slim_doc.raw_node_id,
-                        source=DocumentSource.GOOGLE_DRIVE.value,
-                    )
-                continue
+
             if slim_doc.external_access is None:
                 raise ValueError(
                     f"Drive perm sync: No external access for document {slim_doc.id}"

backend/ee/onyx/external_permissions/google_drive/models.py

@@ -30,10 +30,6 @@ class GoogleDrivePermission(BaseModel):
     type: PermissionType
     domain: str | None  # only applies to domain permissions
     permission_details: GoogleDrivePermissionDetails | None
-    # Whether this permission makes the file discoverable in search
-    # False means "anyone with the link" (not searchable/discoverable)
-    # Only applicable for domain/anyone permission types
-    allow_file_discovery: bool | None
 
     @classmethod
     def from_drive_permission(
@@ -50,7 +46,6 @@ class GoogleDrivePermission(BaseModel):
             email_address=drive_permission.get("emailAddress"),
             type=PermissionType(drive_permission["type"]),
             domain=drive_permission.get("domain"),
-            allow_file_discovery=drive_permission.get("allowFileDiscovery"),
             permission_details=(
                 GoogleDrivePermissionDetails(
                     permission_type=permission_details.get("type"),

backend/ee/onyx/external_permissions/google_drive/permission_retrieval.py

@@ -36,7 +36,7 @@ def get_permissions_by_ids(
         retrieval_function=drive_service.permissions().list,
         list_key="permissions",
         fileId=doc_id,
-        fields="permissions(id, emailAddress, type, domain, allowFileDiscovery, permissionDetails),nextPageToken",
+        fields="permissions(id, emailAddress, type, domain, permissionDetails),nextPageToken",
         supportsAllDrives=True,
         continue_on_404_or_403=True,
     )

backend/ee/onyx/external_permissions/jira/doc_sync.py

@@ -3,7 +3,7 @@ from collections.abc import Generator
 from ee.onyx.external_permissions.perm_sync_types import FetchAllDocumentsFunction
 from ee.onyx.external_permissions.perm_sync_types import FetchAllDocumentsIdsFunction
 from ee.onyx.external_permissions.utils import generic_doc_sync
-from onyx.access.models import ElementExternalAccess
+from onyx.access.models import DocExternalAccess
 from onyx.configs.constants import DocumentSource
 from onyx.connectors.jira.connector import JiraConnector
 from onyx.db.models import ConnectorCredentialPair
@@ -20,7 +20,7 @@ def jira_doc_sync(
     fetch_all_existing_docs_fn: FetchAllDocumentsFunction,
     fetch_all_existing_docs_ids_fn: FetchAllDocumentsIdsFunction,
     callback: IndexingHeartbeatInterface | None = None,
-) -> Generator[ElementExternalAccess, None, None]:
+) -> Generator[DocExternalAccess, None, None]:
     jira_connector = JiraConnector(
         **cc_pair.connector.connector_specific_config,
     )

backend/ee/onyx/external_permissions/perm_sync_types.py

@@ -5,8 +5,6 @@ from typing import Protocol
 
 from ee.onyx.db.external_perm import ExternalUserGroup  # noqa
 from onyx.access.models import DocExternalAccess  # noqa
-from onyx.access.models import ElementExternalAccess  # noqa
-from onyx.access.models import NodeExternalAccess  # noqa
 from onyx.context.search.models import InferenceChunk
 from onyx.db.models import ConnectorCredentialPair  # noqa
 from onyx.db.utils import DocumentRow
@@ -55,7 +53,7 @@ DocSyncFuncType = Callable[
         FetchAllDocumentsIdsFunction,
         Optional[IndexingHeartbeatInterface],
     ],
-    Generator[ElementExternalAccess, None, None],
+    Generator[DocExternalAccess, None, None],
 ]
 
 GroupSyncFuncType = Callable[

backend/ee/onyx/external_permissions/post_query_censoring.py

@@ -34,21 +34,21 @@ def _get_all_censoring_enabled_sources() -> set[DocumentSource]:
 # NOTE: This is only called if ee is enabled.
 def _post_query_chunk_censoring(
     chunks: list[InferenceChunk],
-    user: User,
+    user: User | None,
 ) -> list[InferenceChunk]:
     """
     This function checks all chunks to see if they need to be sent to a censoring
     function. If they do, it sends them to the censoring function and returns the
     censored chunks. If they don't, it returns the original chunks.
     """
-    sources_to_censor = _get_all_censoring_enabled_sources()
-
-    # Anonymous users can only access public (non-permission-synced) content
-    if user.is_anonymous:
-        return [chunk for chunk in chunks if chunk.source_type not in sources_to_censor]
+    if user is None:
+        # if user is None, permissions are not enforced
+        return chunks
 
     final_chunk_dict: dict[str, InferenceChunk] = {}
     chunks_to_process: dict[DocumentSource, list[InferenceChunk]] = {}
+
+    sources_to_censor = _get_all_censoring_enabled_sources()
     for chunk in chunks:
         # Separate out chunks that require permission post-processing by source
         if chunk.source_type in sources_to_censor:

backend/ee/onyx/external_permissions/sharepoint/doc_sync.py

@@ -3,7 +3,7 @@ from collections.abc import Generator
 from ee.onyx.external_permissions.perm_sync_types import FetchAllDocumentsFunction
 from ee.onyx.external_permissions.perm_sync_types import FetchAllDocumentsIdsFunction
 from ee.onyx.external_permissions.utils import generic_doc_sync
-from onyx.access.models import ElementExternalAccess
+from onyx.access.models import DocExternalAccess
 from onyx.configs.constants import DocumentSource
 from onyx.connectors.sharepoint.connector import SharepointConnector
 from onyx.db.models import ConnectorCredentialPair
@@ -20,7 +20,7 @@ def sharepoint_doc_sync(
     fetch_all_existing_docs_fn: FetchAllDocumentsFunction,
     fetch_all_existing_docs_ids_fn: FetchAllDocumentsIdsFunction,
     callback: IndexingHeartbeatInterface | None = None,
-) -> Generator[ElementExternalAccess, None, None]:
+) -> Generator[DocExternalAccess, None, None]:
     sharepoint_connector = SharepointConnector(
         **cc_pair.connector.connector_specific_config,
     )

backend/ee/onyx/external_permissions/slack/doc_sync.py

@@ -8,7 +8,6 @@ from ee.onyx.external_permissions.slack.utils import fetch_user_id_to_email_map
 from onyx.access.models import DocExternalAccess
 from onyx.access.models import ExternalAccess
 from onyx.connectors.credentials_provider import OnyxDBCredentialsProvider
-from onyx.connectors.models import HierarchyNode
 from onyx.connectors.slack.connector import get_channels
 from onyx.connectors.slack.connector import make_paginated_slack_api_call
 from onyx.connectors.slack.connector import SlackConnector
@@ -112,9 +111,6 @@ def _get_slack_document_access(
 
     for doc_metadata_batch in slim_doc_generator:
         for doc_metadata in doc_metadata_batch:
-            if isinstance(doc_metadata, HierarchyNode):
-                # TODO: handle hierarchynodes during sync
-                continue
             if doc_metadata.external_access is None:
                 raise ValueError(
                     f"No external access for document {doc_metadata.id}. "

backend/ee/onyx/external_permissions/teams/doc_sync.py

@@ -3,7 +3,7 @@ from collections.abc import Generator
 from ee.onyx.external_permissions.perm_sync_types import FetchAllDocumentsFunction
 from ee.onyx.external_permissions.perm_sync_types import FetchAllDocumentsIdsFunction
 from ee.onyx.external_permissions.utils import generic_doc_sync
-from onyx.access.models import ElementExternalAccess
+from onyx.access.models import DocExternalAccess
 from onyx.configs.constants import DocumentSource
 from onyx.connectors.teams.connector import TeamsConnector
 from onyx.db.models import ConnectorCredentialPair
@@ -21,7 +21,7 @@ def teams_doc_sync(
     fetch_all_existing_docs_fn: FetchAllDocumentsFunction,
     fetch_all_existing_docs_ids_fn: FetchAllDocumentsIdsFunction,
     callback: IndexingHeartbeatInterface | None,
-) -> Generator[ElementExternalAccess, None, None]:
+) -> Generator[DocExternalAccess, None, None]:
     teams_connector = TeamsConnector(
         **cc_pair.connector.connector_specific_config,
     )

backend/ee/onyx/external_permissions/utils.py

@@ -2,12 +2,9 @@ from collections.abc import Generator
 
 from ee.onyx.external_permissions.perm_sync_types import FetchAllDocumentsIdsFunction
 from onyx.access.models import DocExternalAccess
-from onyx.access.models import ElementExternalAccess
 from onyx.access.models import ExternalAccess
-from onyx.access.models import NodeExternalAccess
 from onyx.configs.constants import DocumentSource
 from onyx.connectors.interfaces import SlimConnectorWithPermSync
-from onyx.connectors.models import HierarchyNode
 from onyx.db.models import ConnectorCredentialPair
 from onyx.indexing.indexing_heartbeat import IndexingHeartbeatInterface
 from onyx.utils.logger import setup_logger
@@ -22,7 +19,7 @@ def generic_doc_sync(
     doc_source: DocumentSource,
     slim_connector: SlimConnectorWithPermSync,
     label: str,
-) -> Generator[ElementExternalAccess, None, None]:
+) -> Generator[DocExternalAccess, None, None]:
     """
     A convenience function for performing a generic document synchronization.
 
@@ -32,7 +29,7 @@ def generic_doc_sync(
         - fetching *all* new (slim) docs
         - yielding external-access permissions for existing docs which do not exist in the newly fetched slim-docs set (with their
         `external_access` set to "private")
-        - yielding external-access permissions for newly fetched docs and hierarchy nodes
+        - yielding external-access permissions for newly fetched docs
 
     Returns:
         A `Generator` which yields existing and newly fetched external-access permissions.
@@ -52,15 +49,6 @@ def generic_doc_sync(
             callback.progress(label, 1)
 
         for doc in doc_batch:
-            if isinstance(doc, HierarchyNode):
-                # Yield hierarchy node permissions to be processed in outer layer
-                if doc.external_access:
-                    yield NodeExternalAccess(
-                        external_access=doc.external_access,
-                        raw_node_id=doc.raw_node_id,
-                        source=doc_source.value,
-                    )
-                continue
             if not doc.external_access:
                 raise RuntimeError(
                     f"No external access found for document ID; {cc_pair.id=} {doc_source=} {doc.id=}"

backend/ee/onyx/main.py

@@ -4,10 +4,8 @@ from contextlib import asynccontextmanager
 from fastapi import FastAPI
 from httpx_oauth.clients.google import GoogleOAuth2
 
-from ee.onyx.configs.app_configs import LICENSE_ENFORCEMENT_ENABLED
 from ee.onyx.server.analytics.api import router as analytics_router
 from ee.onyx.server.auth_check import check_ee_router_auth
-from ee.onyx.server.billing.api import router as billing_router
 from ee.onyx.server.documents.cc_pair import router as ee_document_cc_pair_router
 from ee.onyx.server.enterprise_settings.api import (
     admin_router as enterprise_settings_admin_router,
@@ -18,17 +16,16 @@ from ee.onyx.server.enterprise_settings.api import (
 from ee.onyx.server.evals.api import router as evals_router
 from ee.onyx.server.license.api import router as license_router
 from ee.onyx.server.manage.standard_answer import router as standard_answer_router
-from ee.onyx.server.middleware.license_enforcement import (
-    add_license_enforcement_middleware,
-)
 from ee.onyx.server.middleware.tenant_tracking import (
     add_api_server_tenant_id_middleware,
 )
 from ee.onyx.server.oauth.api import router as ee_oauth_router
+from ee.onyx.server.query_and_chat.chat_backend import (
+    router as chat_router,
+)
 from ee.onyx.server.query_and_chat.query_backend import (
     basic_router as ee_query_router,
 )
-from ee.onyx.server.query_and_chat.search_backend import router as search_router
 from ee.onyx.server.query_history.api import router as query_history_router
 from ee.onyx.server.reporting.usage_export_api import router as usage_export_router
 from ee.onyx.server.seeding import seed_db
@@ -87,11 +84,6 @@ def get_application() -> FastAPI:
 
     if MULTI_TENANT:
         add_api_server_tenant_id_middleware(application, logger)
-    else:
-        # License enforcement middleware for self-hosted deployments only
-        # Checks LICENSE_ENFORCEMENT_ENABLED at runtime (can be toggled without restart)
-        # MT deployments use control plane gating via is_tenant_gated() instead
-        add_license_enforcement_middleware(application, logger)
 
     if AUTH_TYPE == AuthType.CLOUD:
         # For Google OAuth, refresh tokens are requested by:
@@ -132,7 +124,7 @@ def get_application() -> FastAPI:
     # EE only backend APIs
     include_router_with_global_prefix_prepended(application, query_router)
     include_router_with_global_prefix_prepended(application, ee_query_router)
-    include_router_with_global_prefix_prepended(application, search_router)
+    include_router_with_global_prefix_prepended(application, chat_router)
     include_router_with_global_prefix_prepended(application, standard_answer_router)
     include_router_with_global_prefix_prepended(application, ee_oauth_router)
     include_router_with_global_prefix_prepended(application, ee_document_cc_pair_router)
@@ -151,13 +143,6 @@ def get_application() -> FastAPI:
     # License management
     include_router_with_global_prefix_prepended(application, license_router)
 
-    # Unified billing API - available when license system is enabled
-    # Works for both self-hosted and cloud deployments
-    # TODO(ENG-3533): Once frontend migrates to /admin/billing/*, this becomes the
-    # primary billing API and /tenants/* billing endpoints can be removed
-    if LICENSE_ENFORCEMENT_ENABLED:
-        include_router_with_global_prefix_prepended(application, billing_router)
-
     if MULTI_TENANT:
         # Tenant management
         include_router_with_global_prefix_prepended(application, tenants_router)

backend/ee/onyx/prompts/query_expansion.py

@@ -1,27 +0,0 @@
-# Single message is likely most reliable and generally better for this task
-# No final reminders at the end since the user query is expected to be short
-# If it is not short, it should go into the chat flow so we do not need to account for this.
-KEYWORD_EXPANSION_PROMPT = """
-Generate a set of keyword-only queries to help find relevant documents for the provided query. \
-These queries will be passed to a bm25-based keyword search engine. \
-Provide a single query per line (where each query consists of one or more keywords). \
-The queries must be purely keywords and not contain any filler natural language. \
-The each query should have as few keywords as necessary to represent the user's search intent. \
-If there are no useful expansions, simply return the original query with no additional keyword queries. \
-CRITICAL: Do not include any additional formatting, comments, or anything aside from the keyword queries.
-
-The user query is:
-{user_query}
-""".strip()
-
-
-QUERY_TYPE_PROMPT = """
-Determine if the provided query is better suited for a keyword search or a semantic search.
-Respond with "keyword" or "semantic" literally and nothing else.
-Do not provide any additional text or reasoning to your response.
-
-CRITICAL: It must only be 1 single word - EITHER "keyword" or "semantic".
-
-The user query is:
-{user_query}
-""".strip()

backend/ee/onyx/prompts/search_flow_classification.py

@@ -1,42 +0,0 @@
-# ruff: noqa: E501, W605 start
-SEARCH_CLASS = "search"
-CHAT_CLASS = "chat"
-
-# Will note that with many larger LLMs the latency on running this prompt via third party APIs is as high as 2 seconds which is too slow for many
-# use cases.
-SEARCH_CHAT_PROMPT = f"""
-Determine if the following query is better suited for a search UI or a chat UI. Respond with "{SEARCH_CLASS}" or "{CHAT_CLASS}" literally and nothing else. \
-Do not provide any additional text or reasoning to your response. CRITICAL, IT MUST ONLY BE 1 SINGLE WORD - EITHER "{SEARCH_CLASS}" or "{CHAT_CLASS}".
-
-# Classification Guidelines:
-## {SEARCH_CLASS}
-- If the query consists entirely of keywords or query doesn't require any answer from the AI
-- If the query is a short statement that seems like a search query rather than a question
-- If the query feels nonsensical or is a short phrase that possibly describes a document or information that could be found in a internal document
-
-### Examples of {SEARCH_CLASS} queries:
-- Find me the document that goes over the onboarding process for a new hire
-- Pull requests since last week
-- Sales Runbook AMEA Region
-- Procurement process
-- Retrieve the PRD for project X
-
-## {CHAT_CLASS}
-- If the query is asking a question that requires an answer rather than a document
-- If the query is asking for a solution, suggestion, or general help
-- If the query is seeking information that is on the web and likely not in a company internal document
-- If the query should be answered without any context from additional documents or searches
-
-### Examples of {CHAT_CLASS} queries:
-- What led us to win the deal with company X? (seeking answer)
-- Google Drive not sync-ing files to my computer (seeking solution)
-- Review my email: <whatever the email is> (general help)
-- Write me a script to... (general help)
-- Cheap flights Europe to Tokyo (information likely found on the web, not internal)
-
-# User Query:
-{{user_query}}
-
-REMEMBER TO ONLY RESPOND WITH "{SEARCH_CLASS}" OR "{CHAT_CLASS}" AND NOTHING ELSE.
-""".strip()
-# ruff: noqa: E501, W605 end

backend/ee/onyx/search/process_search_query.py

@@ -1,285 +0,0 @@
-from collections.abc import Generator
-
-from sqlalchemy.orm import Session
-
-from ee.onyx.db.search import create_search_query
-from ee.onyx.secondary_llm_flows.query_expansion import expand_keywords
-from ee.onyx.server.query_and_chat.models import SearchDocWithContent
-from ee.onyx.server.query_and_chat.models import SearchFullResponse
-from ee.onyx.server.query_and_chat.models import SendSearchQueryRequest
-from ee.onyx.server.query_and_chat.streaming_models import LLMSelectedDocsPacket
-from ee.onyx.server.query_and_chat.streaming_models import SearchDocsPacket
-from ee.onyx.server.query_and_chat.streaming_models import SearchErrorPacket
-from ee.onyx.server.query_and_chat.streaming_models import SearchQueriesPacket
-from onyx.context.search.models import BaseFilters
-from onyx.context.search.models import ChunkSearchRequest
-from onyx.context.search.models import InferenceChunk
-from onyx.context.search.pipeline import merge_individual_chunks
-from onyx.context.search.pipeline import search_pipeline
-from onyx.db.models import User
-from onyx.db.search_settings import get_current_search_settings
-from onyx.document_index.factory import get_default_document_index
-from onyx.document_index.interfaces import DocumentIndex
-from onyx.llm.factory import get_default_llm
-from onyx.secondary_llm_flows.document_filter import select_sections_for_expansion
-from onyx.tools.tool_implementations.search.search_utils import (
-    weighted_reciprocal_rank_fusion,
-)
-from onyx.utils.logger import setup_logger
-from onyx.utils.threadpool_concurrency import run_functions_tuples_in_parallel
-
-logger = setup_logger()
-
-
-# This is just a heuristic that also happens to work well for the UI/UX
-# Users would not find it useful to see a huge list of suggested docs
-# but more than 1 is also likely good as many questions may target more than 1 doc.
-TARGET_NUM_SECTIONS_FOR_LLM_SELECTION = 3
-
-
-def _run_single_search(
-    query: str,
-    filters: BaseFilters | None,
-    document_index: DocumentIndex,
-    user: User,
-    db_session: Session,
-    num_hits: int | None = None,
-) -> list[InferenceChunk]:
-    """Execute a single search query and return chunks."""
-    chunk_search_request = ChunkSearchRequest(
-        query=query,
-        user_selected_filters=filters,
-        limit=num_hits,
-    )
-
-    return search_pipeline(
-        chunk_search_request=chunk_search_request,
-        document_index=document_index,
-        user=user,
-        persona=None,  # No persona for direct search
-        db_session=db_session,
-    )
-
-
-def stream_search_query(
-    request: SendSearchQueryRequest,
-    user: User,
-    db_session: Session,
-) -> Generator[
-    SearchQueriesPacket | SearchDocsPacket | LLMSelectedDocsPacket | SearchErrorPacket,
-    None,
-    None,
-]:
-    """
-    Core search function that yields streaming packets.
-    Used by both streaming and non-streaming endpoints.
-    """
-    # Get document index
-    search_settings = get_current_search_settings(db_session)
-    # This flow is for search so we do not get all indices.
-    document_index = get_default_document_index(search_settings, None)
-
-    # Determine queries to execute
-    original_query = request.search_query
-    keyword_expansions: list[str] = []
-
-    if request.run_query_expansion:
-        try:
-            llm = get_default_llm()
-            keyword_expansions = expand_keywords(
-                user_query=original_query,
-                llm=llm,
-            )
-            if keyword_expansions:
-                logger.debug(
-                    f"Query expansion generated {len(keyword_expansions)} keyword queries"
-                )
-        except Exception as e:
-            logger.warning(f"Query expansion failed: {e}; using original query only.")
-            keyword_expansions = []
-
-    # Build list of all executed queries for tracking
-    all_executed_queries = [original_query] + keyword_expansions
-
-    if not user.is_anonymous:
-        create_search_query(
-            db_session=db_session,
-            user_id=user.id,
-            query=request.search_query,
-            query_expansions=keyword_expansions if keyword_expansions else None,
-        )
-
-    # Execute search(es)
-    if not keyword_expansions:
-        # Single query (original only) - no threading needed
-        chunks = _run_single_search(
-            query=original_query,
-            filters=request.filters,
-            document_index=document_index,
-            user=user,
-            db_session=db_session,
-            num_hits=request.num_hits,
-        )
-    else:
-        # Multiple queries - run in parallel and merge with RRF
-        # First query is the original (semantic), rest are keyword expansions
-        search_functions = [
-            (
-                _run_single_search,
-                (
-                    query,
-                    request.filters,
-                    document_index,
-                    user,
-                    db_session,
-                    request.num_hits,
-                ),
-            )
-            for query in all_executed_queries
-        ]
-
-        # Run all searches in parallel
-        all_search_results: list[list[InferenceChunk]] = (
-            run_functions_tuples_in_parallel(
-                search_functions,
-                allow_failures=True,
-            )
-        )
-
-        # Separate original query results from keyword expansion results
-        # Note that in rare cases, the original query may have failed and so we may be
-        # just overweighting one set of keyword results, should be not a big deal though.
-        original_result = all_search_results[0] if all_search_results else []
-        keyword_results = all_search_results[1:] if len(all_search_results) > 1 else []
-
-        # Build valid results and weights
-        # Original query (semantic): weight 2.0
-        # Keyword expansions: weight 1.0 each
-        valid_results: list[list[InferenceChunk]] = []
-        weights: list[float] = []
-
-        if original_result:
-            valid_results.append(original_result)
-            weights.append(2.0)
-
-        for keyword_result in keyword_results:
-            if keyword_result:
-                valid_results.append(keyword_result)
-                weights.append(1.0)
-
-        if not valid_results:
-            logger.warning("All parallel searches returned empty results")
-            chunks = []
-        else:
-            chunks = weighted_reciprocal_rank_fusion(
-                ranked_results=valid_results,
-                weights=weights,
-                id_extractor=lambda chunk: f"{chunk.document_id}_{chunk.chunk_id}",
-            )
-
-    # Merge chunks into sections
-    sections = merge_individual_chunks(chunks)
-
-    # Truncate to the requested number of hits
-    sections = sections[: request.num_hits]
-
-    # Apply LLM document selection if requested
-    # num_docs_fed_to_llm_selection specifies how many sections to feed to the LLM for selection
-    # The LLM will always try to select TARGET_NUM_SECTIONS_FOR_LLM_SELECTION sections from those fed to it
-    # llm_selected_doc_ids will be:
-    #   - None if LLM selection was not requested or failed
-    #   - Empty list if LLM selection ran but selected nothing
-    #   - List of doc IDs if LLM selection succeeded
-    run_llm_selection = (
-        request.num_docs_fed_to_llm_selection is not None
-        and request.num_docs_fed_to_llm_selection >= 1
-    )
-    llm_selected_doc_ids: list[str] | None = None
-    llm_selection_failed = False
-    if run_llm_selection and sections:
-        try:
-            llm = get_default_llm()
-            sections_to_evaluate = sections[: request.num_docs_fed_to_llm_selection]
-            selected_sections, _ = select_sections_for_expansion(
-                sections=sections_to_evaluate,
-                user_query=original_query,
-                llm=llm,
-                max_sections=TARGET_NUM_SECTIONS_FOR_LLM_SELECTION,
-                try_to_fill_to_max=True,
-            )
-            # Extract unique document IDs from selected sections (may be empty)
-            llm_selected_doc_ids = list(
-                dict.fromkeys(
-                    section.center_chunk.document_id for section in selected_sections
-                )
-            )
-            logger.debug(
-                f"LLM document selection evaluated {len(sections_to_evaluate)} sections, "
-                f"selected {len(selected_sections)} sections with doc IDs: {llm_selected_doc_ids}"
-            )
-        except Exception as e:
-            # Allowing a blanket exception here as this step is not critical and the rest of the results are still valid
-            logger.warning(f"LLM document selection failed: {e}")
-            llm_selection_failed = True
-    elif run_llm_selection and not sections:
-        # LLM selection requested but no sections to evaluate
-        llm_selected_doc_ids = []
-
-    # Convert to SearchDocWithContent list, optionally including content
-    search_docs = SearchDocWithContent.from_inference_sections(
-        sections,
-        include_content=request.include_content,
-        is_internet=False,
-    )
-
-    # Yield queries packet
-    yield SearchQueriesPacket(all_executed_queries=all_executed_queries)
-
-    # Yield docs packet
-    yield SearchDocsPacket(search_docs=search_docs)
-
-    # Yield LLM selected docs packet if LLM selection was requested
-    # - llm_selected_doc_ids is None if selection failed
-    # - llm_selected_doc_ids is empty list if no docs were selected
-    # - llm_selected_doc_ids is list of IDs if docs were selected
-    if run_llm_selection:
-        yield LLMSelectedDocsPacket(
-            llm_selected_doc_ids=None if llm_selection_failed else llm_selected_doc_ids
-        )
-
-
-def gather_search_stream(
-    packets: Generator[
-        SearchQueriesPacket
-        | SearchDocsPacket
-        | LLMSelectedDocsPacket
-        | SearchErrorPacket,
-        None,
-        None,
-    ],
-) -> SearchFullResponse:
-    """
-    Aggregate all streaming packets into SearchFullResponse.
-    """
-    all_executed_queries: list[str] = []
-    search_docs: list[SearchDocWithContent] = []
-    llm_selected_doc_ids: list[str] | None = None
-    error: str | None = None
-
-    for packet in packets:
-        if isinstance(packet, SearchQueriesPacket):
-            all_executed_queries = packet.all_executed_queries
-        elif isinstance(packet, SearchDocsPacket):
-            search_docs = packet.search_docs
-        elif isinstance(packet, LLMSelectedDocsPacket):
-            llm_selected_doc_ids = packet.llm_selected_doc_ids
-        elif isinstance(packet, SearchErrorPacket):
-            error = packet.error
-
-    return SearchFullResponse(
-        all_executed_queries=all_executed_queries,
-        search_docs=search_docs,
-        doc_selection_reasoning=None,
-        llm_selected_doc_ids=llm_selected_doc_ids,
-        error=error,
-    )

backend/ee/onyx/secondary_llm_flows/query_expansion.py

@@ -1,92 +0,0 @@
-import re
-
-from ee.onyx.prompts.query_expansion import KEYWORD_EXPANSION_PROMPT
-from onyx.llm.interfaces import LLM
-from onyx.llm.models import LanguageModelInput
-from onyx.llm.models import ReasoningEffort
-from onyx.llm.models import UserMessage
-from onyx.llm.utils import llm_response_to_string
-from onyx.utils.logger import setup_logger
-
-logger = setup_logger()
-
-# Pattern to remove common LLM artifacts: brackets, quotes, list markers, etc.
-CLEANUP_PATTERN = re.compile(r'[\[\]"\'`]')
-
-
-def _clean_keyword_line(line: str) -> str:
-    """Clean a keyword line by removing common LLM artifacts.
-
-    Removes brackets, quotes, and other characters that LLMs may accidentally
-    include in their output.
-    """
-    # Remove common artifacts
-    cleaned = CLEANUP_PATTERN.sub("", line)
-    # Remove leading list markers like "1.", "2.", "-", "*"
-    cleaned = re.sub(r"^\s*(?:\d+[\.\)]\s*|[-*]\s*)", "", cleaned)
-    return cleaned.strip()
-
-
-def expand_keywords(
-    user_query: str,
-    llm: LLM,
-) -> list[str]:
-    """Expand a user query into multiple keyword-only queries for BM25 search.
-
-    Uses an LLM to generate keyword-based search queries that capture different
-    aspects of the user's search intent. Returns only the expanded queries,
-    not the original query.
-
-    Args:
-        user_query: The original search query from the user
-        llm: Language model to use for keyword expansion
-
-    Returns:
-        List of expanded keyword queries (excluding the original query).
-        Returns empty list if expansion fails or produces no useful expansions.
-    """
-    messages: LanguageModelInput = [
-        UserMessage(content=KEYWORD_EXPANSION_PROMPT.format(user_query=user_query))
-    ]
-
-    try:
-        response = llm.invoke(
-            prompt=messages,
-            reasoning_effort=ReasoningEffort.OFF,
-            # Limit output - we only expect a few short keyword queries
-            max_tokens=150,
-        )
-
-        content = llm_response_to_string(response).strip()
-
-        if not content:
-            logger.warning("Keyword expansion returned empty response.")
-            return []
-
-        # Parse response - each line is a separate keyword query
-        # Clean each line to remove LLM artifacts and drop empty lines
-        parsed_queries = []
-        for line in content.strip().split("\n"):
-            cleaned = _clean_keyword_line(line)
-            if cleaned:
-                parsed_queries.append(cleaned)
-
-        if not parsed_queries:
-            logger.warning("Keyword expansion parsing returned no queries.")
-            return []
-
-        # Filter out duplicates and queries that match the original
-        expanded_queries: list[str] = []
-        seen_lower: set[str] = {user_query.lower()}
-        for query in parsed_queries:
-            query_lower = query.lower()
-            if query_lower not in seen_lower:
-                seen_lower.add(query_lower)
-                expanded_queries.append(query)
-
-        logger.debug(f"Keyword expansion generated {len(expanded_queries)} queries")
-        return expanded_queries
-
-    except Exception as e:
-        logger.warning(f"Keyword expansion failed: {e}")
-        return []

backend/ee/onyx/secondary_llm_flows/search_flow_classification.py

@@ -1,50 +0,0 @@
-from ee.onyx.prompts.search_flow_classification import CHAT_CLASS
-from ee.onyx.prompts.search_flow_classification import SEARCH_CHAT_PROMPT
-from ee.onyx.prompts.search_flow_classification import SEARCH_CLASS
-from onyx.llm.interfaces import LLM
-from onyx.llm.models import LanguageModelInput
-from onyx.llm.models import ReasoningEffort
-from onyx.llm.models import UserMessage
-from onyx.llm.utils import llm_response_to_string
-from onyx.utils.logger import setup_logger
-from onyx.utils.timing import log_function_time
-
-logger = setup_logger()
-
-
-@log_function_time(print_only=True)
-def classify_is_search_flow(
-    query: str,
-    llm: LLM,
-) -> bool:
-    messages: LanguageModelInput = [
-        UserMessage(content=SEARCH_CHAT_PROMPT.format(user_query=query))
-    ]
-    response = llm.invoke(
-        prompt=messages,
-        reasoning_effort=ReasoningEffort.OFF,
-        # Nothing can happen in the UI until this call finishes so we need to be aggressive with the timeout
-        timeout_override=2,
-        # Well more than necessary but just to ensure completion and in case it succeeds with classifying but
-        # ends up rambling
-        max_tokens=20,
-    )
-
-    content = llm_response_to_string(response).strip().lower()
-    if not content:
-        logger.warning(
-            "Search flow classification returned empty response; defaulting to chat flow."
-        )
-        return False
-
-    # Prefer chat if both appear.
-    if CHAT_CLASS in content:
-        return False
-    if SEARCH_CLASS in content:
-        return True
-
-    logger.warning(
-        "Search flow classification returned unexpected response; defaulting to chat flow. Response=%r",
-        content,
-    )
-    return False

backend/ee/onyx/server/analytics/api.py

@@ -19,9 +19,9 @@ from ee.onyx.db.analytics import fetch_query_analytics
 from ee.onyx.db.analytics import user_can_view_assistant_stats
 from onyx.auth.users import current_admin_user
 from onyx.auth.users import current_user
-from onyx.configs.constants import PUBLIC_API_TAGS
 from onyx.db.engine.sql_engine import get_session
 from onyx.db.models import User
+from onyx.server.utils import PUBLIC_API_TAGS
 
 router = APIRouter(prefix="/analytics", tags=PUBLIC_API_TAGS)
 
@@ -40,7 +40,7 @@ class QueryAnalyticsResponse(BaseModel):
 def get_query_analytics(
     start: datetime.datetime | None = None,
     end: datetime.datetime | None = None,
-    _: User = Depends(current_admin_user),
+    _: User | None = Depends(current_admin_user),
     db_session: Session = Depends(get_session),
 ) -> list[QueryAnalyticsResponse]:
     daily_query_usage_info = fetch_query_analytics(
@@ -71,7 +71,7 @@ class UserAnalyticsResponse(BaseModel):
 def get_user_analytics(
     start: datetime.datetime | None = None,
     end: datetime.datetime | None = None,
-    _: User = Depends(current_admin_user),
+    _: User | None = Depends(current_admin_user),
     db_session: Session = Depends(get_session),
 ) -> list[UserAnalyticsResponse]:
     daily_query_usage_info_per_user = fetch_per_user_query_analytics(
@@ -105,7 +105,7 @@ class OnyxbotAnalyticsResponse(BaseModel):
 def get_onyxbot_analytics(
     start: datetime.datetime | None = None,
     end: datetime.datetime | None = None,
-    _: User = Depends(current_admin_user),
+    _: User | None = Depends(current_admin_user),
     db_session: Session = Depends(get_session),
 ) -> list[OnyxbotAnalyticsResponse]:
     daily_onyxbot_info = fetch_onyxbot_analytics(
@@ -141,7 +141,7 @@ def get_persona_messages(
     persona_id: int,
     start: datetime.datetime | None = None,
     end: datetime.datetime | None = None,
-    _: User = Depends(current_admin_user),
+    _: User | None = Depends(current_admin_user),
     db_session: Session = Depends(get_session),
 ) -> list[PersonaMessageAnalyticsResponse]:
     """Fetch daily message counts for a single persona within the given time range."""
@@ -179,7 +179,7 @@ def get_persona_unique_users(
     persona_id: int,
     start: datetime.datetime,
     end: datetime.datetime,
-    _: User = Depends(current_admin_user),
+    _: User | None = Depends(current_admin_user),
     db_session: Session = Depends(get_session),
 ) -> list[PersonaUniqueUsersResponse]:
     """Get unique users per day for a single persona."""
@@ -218,7 +218,7 @@ def get_assistant_stats(
     assistant_id: int,
     start: datetime.datetime | None = None,
     end: datetime.datetime | None = None,
-    user: User = Depends(current_user),
+    user: User | None = Depends(current_user),
     db_session: Session = Depends(get_session),
 ) -> AssistantStatsResponse:
     """

backend/ee/onyx/server/auth_check.py

@@ -10,16 +10,6 @@ EE_PUBLIC_ENDPOINT_SPECS = PUBLIC_ENDPOINT_SPECS + [
     ("/enterprise-settings/logo", {"GET"}),
     ("/enterprise-settings/logotype", {"GET"}),
     ("/enterprise-settings/custom-analytics-script", {"GET"}),
-    # Stripe publishable key is safe to expose publicly
-    ("/tenants/stripe-publishable-key", {"GET"}),
-    ("/admin/billing/stripe-publishable-key", {"GET"}),
-    # Proxy endpoints use license-based auth, not user auth
-    ("/proxy/create-checkout-session", {"POST"}),
-    ("/proxy/claim-license", {"POST"}),
-    ("/proxy/create-customer-portal-session", {"POST"}),
-    ("/proxy/billing-information", {"GET"}),
-    ("/proxy/license/{tenant_id}", {"GET"}),
-    ("/proxy/seats/update", {"POST"}),
 ]
 
 

backend/ee/onyx/server/billing/api.py

@@ -1,373 +0,0 @@
-"""Unified Billing API endpoints.
-
-These endpoints provide Stripe billing functionality for both cloud and
-self-hosted deployments. The service layer routes requests appropriately:
-
-- Self-hosted: Routes through cloud data plane proxy
-  Flow: Backend /admin/billing/* → Cloud DP /proxy/* → Control plane
-
-- Cloud (MULTI_TENANT): Routes directly to control plane
-  Flow: Backend /admin/billing/* → Control plane
-
-License claiming is handled separately by /license/claim endpoint (self-hosted only).
-
-Migration Note (ENG-3533):
-This /admin/billing/* API replaces the older /tenants/* billing endpoints:
-- /tenants/billing-information            -> /admin/billing/billing-information
-- /tenants/create-customer-portal-session -> /admin/billing/create-customer-portal-session
-- /tenants/create-subscription-session    -> /admin/billing/create-checkout-session
-- /tenants/stripe-publishable-key         -> /admin/billing/stripe-publishable-key
-
-See: https://linear.app/onyx-app/issue/ENG-3533/migrate-tenantsbilling-adminbilling
-"""
-
-import asyncio
-
-import httpx
-from fastapi import APIRouter
-from fastapi import Depends
-from fastapi import HTTPException
-from pydantic import BaseModel
-from sqlalchemy.orm import Session
-
-from ee.onyx.auth.users import current_admin_user
-from ee.onyx.db.license import get_license
-from ee.onyx.server.billing.models import BillingInformationResponse
-from ee.onyx.server.billing.models import CreateCheckoutSessionRequest
-from ee.onyx.server.billing.models import CreateCheckoutSessionResponse
-from ee.onyx.server.billing.models import CreateCustomerPortalSessionRequest
-from ee.onyx.server.billing.models import CreateCustomerPortalSessionResponse
-from ee.onyx.server.billing.models import SeatUpdateRequest
-from ee.onyx.server.billing.models import SeatUpdateResponse
-from ee.onyx.server.billing.models import StripePublishableKeyResponse
-from ee.onyx.server.billing.models import SubscriptionStatusResponse
-from ee.onyx.server.billing.service import BillingServiceError
-from ee.onyx.server.billing.service import (
-    create_checkout_session as create_checkout_service,
-)
-from ee.onyx.server.billing.service import (
-    create_customer_portal_session as create_portal_service,
-)
-from ee.onyx.server.billing.service import (
-    get_billing_information as get_billing_service,
-)
-from ee.onyx.server.billing.service import update_seat_count as update_seat_service
-from onyx.auth.users import User
-from onyx.configs.app_configs import STRIPE_PUBLISHABLE_KEY_OVERRIDE
-from onyx.configs.app_configs import STRIPE_PUBLISHABLE_KEY_URL
-from onyx.configs.app_configs import WEB_DOMAIN
-from onyx.db.engine.sql_engine import get_session
-from onyx.redis.redis_pool import get_shared_redis_client
-from onyx.utils.logger import setup_logger
-from shared_configs.configs import MULTI_TENANT
-from shared_configs.contextvars import get_current_tenant_id
-
-logger = setup_logger()
-
-router = APIRouter(prefix="/admin/billing")
-
-# Cache for Stripe publishable key to avoid hitting S3 on every request
-_stripe_publishable_key_cache: str | None = None
-_stripe_key_lock = asyncio.Lock()
-
-# Redis key for billing circuit breaker (self-hosted only)
-# When set, billing requests to Stripe are disabled until user manually retries
-BILLING_CIRCUIT_BREAKER_KEY = "billing_circuit_open"
-# Circuit breaker auto-expires after 1 hour (user can manually retry sooner)
-BILLING_CIRCUIT_BREAKER_TTL_SECONDS = 3600
-
-
-def _is_billing_circuit_open() -> bool:
-    """Check if the billing circuit breaker is open (self-hosted only)."""
-    if MULTI_TENANT:
-        return False
-    try:
-        redis_client = get_shared_redis_client()
-        is_open = bool(redis_client.exists(BILLING_CIRCUIT_BREAKER_KEY))
-        logger.debug(
-            f"Circuit breaker check: key={BILLING_CIRCUIT_BREAKER_KEY}, is_open={is_open}"
-        )
-        return is_open
-    except Exception as e:
-        logger.error(f"Failed to check circuit breaker: {e}")
-        return False
-
-
-def _open_billing_circuit() -> None:
-    """Open the billing circuit breaker after a failure (self-hosted only)."""
-    if MULTI_TENANT:
-        return
-    try:
-        redis_client = get_shared_redis_client()
-        redis_client.set(
-            BILLING_CIRCUIT_BREAKER_KEY,
-            "1",
-            ex=BILLING_CIRCUIT_BREAKER_TTL_SECONDS,
-        )
-        # Verify it was set
-        exists = redis_client.exists(BILLING_CIRCUIT_BREAKER_KEY)
-        logger.warning(
-            f"Billing circuit breaker opened (TTL={BILLING_CIRCUIT_BREAKER_TTL_SECONDS}s, "
-            f"verified={exists}). Stripe billing requests are disabled until manually reset."
-        )
-    except Exception as e:
-        logger.error(f"Failed to open circuit breaker: {e}")
-
-
-def _close_billing_circuit() -> None:
-    """Close the billing circuit breaker (re-enable Stripe requests)."""
-    if MULTI_TENANT:
-        return
-    try:
-        redis_client = get_shared_redis_client()
-        redis_client.delete(BILLING_CIRCUIT_BREAKER_KEY)
-        logger.info(
-            "Billing circuit breaker closed. Stripe billing requests re-enabled."
-        )
-    except Exception as e:
-        logger.error(f"Failed to close circuit breaker: {e}")
-
-
-def _get_license_data(db_session: Session) -> str | None:
-    """Get license data from database if exists (self-hosted only)."""
-    if MULTI_TENANT:
-        return None
-    license_record = get_license(db_session)
-    return license_record.license_data if license_record else None
-
-
-def _get_tenant_id() -> str | None:
-    """Get tenant ID for cloud deployments."""
-    if MULTI_TENANT:
-        return get_current_tenant_id()
-    return None
-
-
-@router.post("/create-checkout-session")
-async def create_checkout_session(
-    request: CreateCheckoutSessionRequest | None = None,
-    _: User = Depends(current_admin_user),
-    db_session: Session = Depends(get_session),
-) -> CreateCheckoutSessionResponse:
-    """Create a Stripe checkout session for new subscription or renewal.
-
-    For new customers, no license/tenant is required.
-    For renewals, existing license (self-hosted) or tenant_id (cloud) is used.
-
-    After checkout completion:
-    - Self-hosted: Use /license/claim to retrieve the license
-    - Cloud: Subscription is automatically activated
-    """
-    license_data = _get_license_data(db_session)
-    tenant_id = _get_tenant_id()
-    billing_period = request.billing_period if request else "monthly"
-    seats = request.seats if request else None
-    email = request.email if request else None
-
-    # Build redirect URL for after checkout completion
-    redirect_url = f"{WEB_DOMAIN}/admin/billing?checkout=success"
-
-    try:
-        return await create_checkout_service(
-            billing_period=billing_period,
-            seats=seats,
-            email=email,
-            license_data=license_data,
-            redirect_url=redirect_url,
-            tenant_id=tenant_id,
-        )
-    except BillingServiceError as e:
-        raise HTTPException(status_code=e.status_code, detail=e.message)
-
-
-@router.post("/create-customer-portal-session")
-async def create_customer_portal_session(
-    request: CreateCustomerPortalSessionRequest | None = None,
-    _: User = Depends(current_admin_user),
-    db_session: Session = Depends(get_session),
-) -> CreateCustomerPortalSessionResponse:
-    """Create a Stripe customer portal session for managing subscription.
-
-    Requires existing license (self-hosted) or active tenant (cloud).
-    """
-    license_data = _get_license_data(db_session)
-    tenant_id = _get_tenant_id()
-
-    # Self-hosted requires license
-    if not MULTI_TENANT and not license_data:
-        raise HTTPException(status_code=400, detail="No license found")
-
-    return_url = request.return_url if request else f"{WEB_DOMAIN}/admin/billing"
-
-    try:
-        return await create_portal_service(
-            license_data=license_data,
-            return_url=return_url,
-            tenant_id=tenant_id,
-        )
-    except BillingServiceError as e:
-        raise HTTPException(status_code=e.status_code, detail=e.message)
-
-
-@router.get("/billing-information")
-async def get_billing_information(
-    _: User = Depends(current_admin_user),
-    db_session: Session = Depends(get_session),
-) -> BillingInformationResponse | SubscriptionStatusResponse:
-    """Get billing information for the current subscription.
-
-    Returns subscription status and details from Stripe.
-    For self-hosted: If the circuit breaker is open (previous failure),
-    returns a 503 error without making the request.
-    """
-    license_data = _get_license_data(db_session)
-    tenant_id = _get_tenant_id()
-
-    # Self-hosted without license = no subscription
-    if not MULTI_TENANT and not license_data:
-        return SubscriptionStatusResponse(subscribed=False)
-
-    # Check circuit breaker (self-hosted only)
-    if _is_billing_circuit_open():
-        raise HTTPException(
-            status_code=503,
-            detail="Stripe connection temporarily disabled. Click 'Connect to Stripe' to retry.",
-        )
-
-    try:
-        return await get_billing_service(
-            license_data=license_data,
-            tenant_id=tenant_id,
-        )
-    except BillingServiceError as e:
-        # Open circuit breaker on connection failures (self-hosted only)
-        if e.status_code in (502, 503, 504):
-            _open_billing_circuit()
-        raise HTTPException(status_code=e.status_code, detail=e.message)
-
-
-@router.post("/seats/update")
-async def update_seats(
-    request: SeatUpdateRequest,
-    _: User = Depends(current_admin_user),
-    db_session: Session = Depends(get_session),
-) -> SeatUpdateResponse:
-    """Update the seat count for the current subscription.
-
-    Handles Stripe proration and license regeneration via control plane.
-    For self-hosted, the frontend should call /license/claim after a short delay
-    to fetch the regenerated license.
-    """
-    license_data = _get_license_data(db_session)
-    tenant_id = _get_tenant_id()
-
-    # Self-hosted requires license
-    if not MULTI_TENANT and not license_data:
-        raise HTTPException(status_code=400, detail="No license found")
-
-    try:
-        result = await update_seat_service(
-            new_seat_count=request.new_seat_count,
-            license_data=license_data,
-            tenant_id=tenant_id,
-        )
-
-        # Note: Don't store license here - the control plane may still be processing
-        # the subscription update. The frontend should call /license/claim after a
-        # short delay to get the freshly generated license.
-
-        return result
-    except BillingServiceError as e:
-        raise HTTPException(status_code=e.status_code, detail=e.message)
-
-
-@router.get("/stripe-publishable-key")
-async def get_stripe_publishable_key() -> StripePublishableKeyResponse:
-    """Fetch the Stripe publishable key.
-
-    Priority: env var override (for testing) > S3 bucket (production).
-    This endpoint is public (no auth required) since publishable keys are safe to expose.
-    The key is cached in memory to avoid hitting S3 on every request.
-    """
-    global _stripe_publishable_key_cache
-
-    # Fast path: return cached value without lock
-    if _stripe_publishable_key_cache:
-        return StripePublishableKeyResponse(
-            publishable_key=_stripe_publishable_key_cache
-        )
-
-    # Use lock to prevent concurrent S3 requests
-    async with _stripe_key_lock:
-        # Double-check after acquiring lock (another request may have populated cache)
-        if _stripe_publishable_key_cache:
-            return StripePublishableKeyResponse(
-                publishable_key=_stripe_publishable_key_cache
-            )
-
-        # Check for env var override first (for local testing with pk_test_* keys)
-        if STRIPE_PUBLISHABLE_KEY_OVERRIDE:
-            key = STRIPE_PUBLISHABLE_KEY_OVERRIDE.strip()
-            if not key.startswith("pk_"):
-                raise HTTPException(
-                    status_code=500,
-                    detail="Invalid Stripe publishable key format",
-                )
-            _stripe_publishable_key_cache = key
-            return StripePublishableKeyResponse(publishable_key=key)
-
-        # Fall back to S3 bucket
-        if not STRIPE_PUBLISHABLE_KEY_URL:
-            raise HTTPException(
-                status_code=500,
-                detail="Stripe publishable key is not configured",
-            )
-
-        try:
-            async with httpx.AsyncClient() as client:
-                response = await client.get(STRIPE_PUBLISHABLE_KEY_URL)
-                response.raise_for_status()
-                key = response.text.strip()
-
-                # Validate key format
-                if not key.startswith("pk_"):
-                    raise HTTPException(
-                        status_code=500,
-                        detail="Invalid Stripe publishable key format",
-                    )
-
-                _stripe_publishable_key_cache = key
-                return StripePublishableKeyResponse(publishable_key=key)
-        except httpx.HTTPError:
-            raise HTTPException(
-                status_code=500,
-                detail="Failed to fetch Stripe publishable key",
-            )
-
-
-class ResetConnectionResponse(BaseModel):
-    success: bool
-    message: str
-
-
-@router.post("/reset-connection")
-async def reset_stripe_connection(
-    _: User = Depends(current_admin_user),
-) -> ResetConnectionResponse:
-    """Reset the Stripe connection circuit breaker.
-
-    Called when user clicks "Connect to Stripe" to retry after a previous failure.
-    This clears the circuit breaker flag, allowing billing requests to proceed again.
-    Self-hosted only - cloud deployments don't use the circuit breaker.
-    """
-    if MULTI_TENANT:
-        return ResetConnectionResponse(
-            success=True,
-            message="Circuit breaker not applicable for cloud deployments",
-        )
-
-    _close_billing_circuit()
-    return ResetConnectionResponse(
-        success=True,
-        message="Stripe connection reset. Billing requests re-enabled.",
-    )

backend/ee/onyx/server/billing/models.py

@@ -1,77 +0,0 @@
-"""Pydantic models for the billing API."""
-
-from datetime import datetime
-from typing import Literal
-
-from pydantic import BaseModel
-
-
-class CreateCheckoutSessionRequest(BaseModel):
-    """Request to create a Stripe checkout session."""
-
-    billing_period: Literal["monthly", "annual"] = "monthly"
-    seats: int | None = None
-    email: str | None = None
-
-
-class CreateCheckoutSessionResponse(BaseModel):
-    """Response containing the Stripe checkout session URL."""
-
-    stripe_checkout_url: str
-
-
-class CreateCustomerPortalSessionRequest(BaseModel):
-    """Request to create a Stripe customer portal session."""
-
-    return_url: str | None = None
-
-
-class CreateCustomerPortalSessionResponse(BaseModel):
-    """Response containing the Stripe customer portal URL."""
-
-    stripe_customer_portal_url: str
-
-
-class BillingInformationResponse(BaseModel):
-    """Billing information for the current subscription."""
-
-    tenant_id: str
-    status: str | None = None
-    plan_type: str | None = None
-    seats: int | None = None
-    billing_period: str | None = None
-    current_period_start: datetime | None = None
-    current_period_end: datetime | None = None
-    cancel_at_period_end: bool = False
-    canceled_at: datetime | None = None
-    trial_start: datetime | None = None
-    trial_end: datetime | None = None
-    payment_method_enabled: bool = False
-
-
-class SubscriptionStatusResponse(BaseModel):
-    """Response when no subscription exists."""
-
-    subscribed: bool = False
-
-
-class SeatUpdateRequest(BaseModel):
-    """Request to update seat count."""
-
-    new_seat_count: int
-
-
-class SeatUpdateResponse(BaseModel):
-    """Response from seat update operation."""
-
-    success: bool
-    current_seats: int
-    used_seats: int
-    message: str | None = None
-    license: str | None = None  # Regenerated license (self-hosted stores this)
-
-
-class StripePublishableKeyResponse(BaseModel):
-    """Response containing the Stripe publishable key."""
-
-    publishable_key: str

backend/ee/onyx/server/billing/service.py

@@ -1,273 +0,0 @@
-"""Service layer for billing operations.
-
-This module provides functions for billing operations that route differently
-based on deployment type:
-
-- Self-hosted (not MULTI_TENANT): Routes through cloud data plane proxy
-  Flow: Self-hosted backend → Cloud DP /proxy/* → Control plane
-
-- Cloud (MULTI_TENANT): Routes directly to control plane
-  Flow: Cloud backend → Control plane
-"""
-
-from typing import Literal
-
-import httpx
-
-from ee.onyx.configs.app_configs import CLOUD_DATA_PLANE_URL
-from ee.onyx.server.billing.models import BillingInformationResponse
-from ee.onyx.server.billing.models import CreateCheckoutSessionResponse
-from ee.onyx.server.billing.models import CreateCustomerPortalSessionResponse
-from ee.onyx.server.billing.models import SeatUpdateResponse
-from ee.onyx.server.billing.models import SubscriptionStatusResponse
-from ee.onyx.server.tenants.access import generate_data_plane_token
-from onyx.configs.app_configs import CONTROL_PLANE_API_BASE_URL
-from onyx.utils.logger import setup_logger
-from shared_configs.configs import MULTI_TENANT
-
-logger = setup_logger()
-
-# HTTP request timeout for billing service calls
-_REQUEST_TIMEOUT = 30.0
-
-
-class BillingServiceError(Exception):
-    """Exception raised for billing service errors."""
-
-    def __init__(self, message: str, status_code: int = 500):
-        self.message = message
-        self.status_code = status_code
-        super().__init__(self.message)
-
-
-def _get_proxy_headers(license_data: str | None) -> dict[str, str]:
-    """Build headers for proxy requests (self-hosted).
-
-    Self-hosted instances authenticate with their license.
-    """
-    headers = {"Content-Type": "application/json"}
-    if license_data:
-        headers["Authorization"] = f"Bearer {license_data}"
-    return headers
-
-
-def _get_direct_headers() -> dict[str, str]:
-    """Build headers for direct control plane requests (cloud).
-
-    Cloud instances authenticate with JWT.
-    """
-    token = generate_data_plane_token()
-    return {
-        "Content-Type": "application/json",
-        "Authorization": f"Bearer {token}",
-    }
-
-
-def _get_base_url() -> str:
-    """Get the base URL based on deployment type."""
-    if MULTI_TENANT:
-        return CONTROL_PLANE_API_BASE_URL
-    return f"{CLOUD_DATA_PLANE_URL}/proxy"
-
-
-def _get_headers(license_data: str | None) -> dict[str, str]:
-    """Get appropriate headers based on deployment type."""
-    if MULTI_TENANT:
-        return _get_direct_headers()
-    return _get_proxy_headers(license_data)
-
-
-async def _make_billing_request(
-    method: Literal["GET", "POST"],
-    path: str,
-    license_data: str | None = None,
-    body: dict | None = None,
-    params: dict | None = None,
-    error_message: str = "Billing service request failed",
-) -> dict:
-    """Make an HTTP request to the billing service.
-
-    Consolidates the common HTTP request pattern used by all billing operations.
-
-    Args:
-        method: HTTP method (GET or POST)
-        path: URL path (appended to base URL)
-        license_data: License for authentication (self-hosted)
-        body: Request body for POST requests
-        params: Query parameters for GET requests
-        error_message: Default error message if request fails
-
-    Returns:
-        Response JSON as dict
-
-    Raises:
-        BillingServiceError: If request fails
-    """
-
-    base_url = _get_base_url()
-    url = f"{base_url}{path}"
-    headers = _get_headers(license_data)
-
-    try:
-        async with httpx.AsyncClient(timeout=_REQUEST_TIMEOUT) as client:
-            if method == "GET":
-                response = await client.get(url, headers=headers, params=params)
-            else:
-                response = await client.post(url, headers=headers, json=body)
-
-            response.raise_for_status()
-            return response.json()
-
-    except httpx.HTTPStatusError as e:
-        detail = error_message
-        try:
-            error_data = e.response.json()
-            detail = error_data.get("detail", detail)
-        except Exception:
-            pass
-        logger.error(f"{error_message}: {e.response.status_code} - {detail}")
-        raise BillingServiceError(detail, e.response.status_code)
-
-    except httpx.RequestError:
-        logger.exception("Failed to connect to billing service")
-        raise BillingServiceError("Failed to connect to billing service", 502)
-
-
-async def create_checkout_session(
-    billing_period: str = "monthly",
-    seats: int | None = None,
-    email: str | None = None,
-    license_data: str | None = None,
-    redirect_url: str | None = None,
-    tenant_id: str | None = None,
-) -> CreateCheckoutSessionResponse:
-    """Create a Stripe checkout session.
-
-    Args:
-        billing_period: "monthly" or "annual"
-        seats: Number of seats to purchase (optional, uses default if not provided)
-        email: Customer email for new subscriptions
-        license_data: Existing license for renewals (self-hosted)
-        redirect_url: URL to redirect after successful checkout
-        tenant_id: Tenant ID (cloud only, for renewals)
-
-    Returns:
-        CreateCheckoutSessionResponse with checkout URL
-    """
-    body: dict = {"billing_period": billing_period}
-    if seats is not None:
-        body["seats"] = seats
-    if email:
-        body["email"] = email
-    if redirect_url:
-        body["redirect_url"] = redirect_url
-    if tenant_id and MULTI_TENANT:
-        body["tenant_id"] = tenant_id
-
-    data = await _make_billing_request(
-        method="POST",
-        path="/create-checkout-session",
-        license_data=license_data,
-        body=body,
-        error_message="Failed to create checkout session",
-    )
-    return CreateCheckoutSessionResponse(stripe_checkout_url=data["url"])
-
-
-async def create_customer_portal_session(
-    license_data: str | None = None,
-    return_url: str | None = None,
-    tenant_id: str | None = None,
-) -> CreateCustomerPortalSessionResponse:
-    """Create a Stripe customer portal session.
-
-    Args:
-        license_data: License blob for authentication (self-hosted)
-        return_url: URL to return to after portal session
-        tenant_id: Tenant ID (cloud only)
-
-    Returns:
-        CreateCustomerPortalSessionResponse with portal URL
-    """
-    body: dict = {}
-    if return_url:
-        body["return_url"] = return_url
-    if tenant_id and MULTI_TENANT:
-        body["tenant_id"] = tenant_id
-
-    data = await _make_billing_request(
-        method="POST",
-        path="/create-customer-portal-session",
-        license_data=license_data,
-        body=body,
-        error_message="Failed to create customer portal session",
-    )
-    return CreateCustomerPortalSessionResponse(stripe_customer_portal_url=data["url"])
-
-
-async def get_billing_information(
-    license_data: str | None = None,
-    tenant_id: str | None = None,
-) -> BillingInformationResponse | SubscriptionStatusResponse:
-    """Fetch billing information.
-
-    Args:
-        license_data: License blob for authentication (self-hosted)
-        tenant_id: Tenant ID (cloud only)
-
-    Returns:
-        BillingInformationResponse or SubscriptionStatusResponse if no subscription
-    """
-    params = {}
-    if tenant_id and MULTI_TENANT:
-        params["tenant_id"] = tenant_id
-
-    data = await _make_billing_request(
-        method="GET",
-        path="/billing-information",
-        license_data=license_data,
-        params=params or None,
-        error_message="Failed to fetch billing information",
-    )
-
-    # Check if no subscription
-    if isinstance(data, dict) and data.get("subscribed") is False:
-        return SubscriptionStatusResponse(subscribed=False)
-
-    return BillingInformationResponse(**data)
-
-
-async def update_seat_count(
-    new_seat_count: int,
-    license_data: str | None = None,
-    tenant_id: str | None = None,
-) -> SeatUpdateResponse:
-    """Update the seat count for the current subscription.
-
-    Args:
-        new_seat_count: New number of seats
-        license_data: License blob for authentication (self-hosted)
-        tenant_id: Tenant ID (cloud only)
-
-    Returns:
-        SeatUpdateResponse with updated seat information
-    """
-    body: dict = {"new_seat_count": new_seat_count}
-    if tenant_id and MULTI_TENANT:
-        body["tenant_id"] = tenant_id
-
-    data = await _make_billing_request(
-        method="POST",
-        path="/seats/update",
-        license_data=license_data,
-        body=body,
-        error_message="Failed to update seat count",
-    )
-
-    return SeatUpdateResponse(
-        success=data.get("success", False),
-        current_seats=data.get("current_seats", 0),
-        used_seats=data.get("used_seats", 0),
-        message=data.get("message"),
-        license=data.get("license"),
-    )

backend/ee/onyx/server/enterprise_settings/api.py

@@ -115,7 +115,7 @@ async def refresh_access_token(
 
 @admin_router.put("")
 def admin_ee_put_settings(
-    settings: EnterpriseSettings, _: User = Depends(current_admin_user)
+    settings: EnterpriseSettings, _: User | None = Depends(current_admin_user)
 ) -> None:
     store_settings(settings)
 
@@ -134,7 +134,7 @@ def ee_fetch_settings() -> EnterpriseSettings:
 def put_logo(
     file: UploadFile,
     is_logotype: bool = False,
-    _: User = Depends(current_admin_user),
+    _: User | None = Depends(current_admin_user),
 ) -> None:
     upload_logo(file=file, is_logotype=is_logotype)
 
@@ -187,7 +187,7 @@ def fetch_logo(
 
 @admin_router.put("/custom-analytics-script")
 def upload_custom_analytics_script(
-    script_upload: AnalyticsScriptUpload, _: User = Depends(current_admin_user)
+    script_upload: AnalyticsScriptUpload, _: User | None = Depends(current_admin_user)
 ) -> None:
     try:
         store_analytics_script(script_upload)

backend/ee/onyx/server/license/api.py

@@ -1,14 +1,4 @@
-"""License API endpoints for self-hosted deployments.
-
-These endpoints allow self-hosted Onyx instances to:
-1. Claim a license after Stripe checkout (via cloud data plane proxy)
-2. Upload a license file manually (for air-gapped deployments)
-3. View license status and seat usage
-4. Refresh/delete the local license
-
-NOTE: Cloud (MULTI_TENANT) deployments do NOT use these endpoints.
-Cloud licensing is managed via the control plane and gated_tenants Redis key.
-"""
+"""License API endpoints."""
 
 import requests
 from fastapi import APIRouter
@@ -19,9 +9,7 @@ from fastapi import UploadFile
 from sqlalchemy.orm import Session
 
 from ee.onyx.auth.users import current_admin_user
-from ee.onyx.configs.app_configs import CLOUD_DATA_PLANE_URL
 from ee.onyx.db.license import delete_license as db_delete_license
-from ee.onyx.db.license import get_license
 from ee.onyx.db.license import get_license_metadata
 from ee.onyx.db.license import invalidate_license_cache
 from ee.onyx.db.license import refresh_license_cache
@@ -32,11 +20,13 @@ from ee.onyx.server.license.models import LicenseSource
 from ee.onyx.server.license.models import LicenseStatusResponse
 from ee.onyx.server.license.models import LicenseUploadResponse
 from ee.onyx.server.license.models import SeatUsageResponse
+from ee.onyx.server.tenants.access import generate_data_plane_token
 from ee.onyx.utils.license import verify_license_signature
 from onyx.auth.users import User
+from onyx.configs.app_configs import CONTROL_PLANE_API_BASE_URL
 from onyx.db.engine.sql_engine import get_session
 from onyx.utils.logger import setup_logger
-from shared_configs.configs import MULTI_TENANT
+from shared_configs.contextvars import get_current_tenant_id
 
 logger = setup_logger()
 
@@ -89,103 +79,81 @@ async def get_seat_usage(
     )
 
 
-@router.post("/claim")
-async def claim_license(
-    session_id: str | None = None,
+@router.post("/fetch")
+async def fetch_license(
     _: User = Depends(current_admin_user),
     db_session: Session = Depends(get_session),
 ) -> LicenseResponse:
     """
-    Claim a license from the control plane (self-hosted only).
-
-    Two modes:
-    1. With session_id: After Stripe checkout, exchange session_id for license
-    2. Without session_id: Re-claim using existing license for auth
-
-    Use without session_id after:
-    - Updating seats via the billing API
-    - Returning from the Stripe customer portal
-    - Any operation that regenerates the license on control plane
+    Fetch license from control plane.
+    Used after Stripe checkout completion to retrieve the new license.
     """
-    if MULTI_TENANT:
+    tenant_id = get_current_tenant_id()
+
+    try:
+        token = generate_data_plane_token()
+    except ValueError as e:
+        logger.error(f"Failed to generate data plane token: {e}")
         raise HTTPException(
-            status_code=400,
-            detail="License claiming is only available for self-hosted deployments",
+            status_code=500, detail="Authentication configuration error"
         )
 
     try:
-        if session_id:
-            # Claim license after checkout using session_id
-            url = f"{CLOUD_DATA_PLANE_URL}/proxy/claim-license"
-            response = requests.post(
-                url,
-                json={"session_id": session_id},
-                headers={"Content-Type": "application/json"},
-                timeout=30,
-            )
-        else:
-            # Re-claim using existing license for auth
-            metadata = get_license_metadata(db_session)
-            if not metadata or not metadata.tenant_id:
-                raise HTTPException(
-                    status_code=400,
-                    detail="No license found. Provide session_id after checkout.",
-                )
-
-            license_row = get_license(db_session)
-            if not license_row or not license_row.license_data:
-                raise HTTPException(
-                    status_code=400, detail="No license found in database"
-                )
-
-            url = f"{CLOUD_DATA_PLANE_URL}/proxy/license/{metadata.tenant_id}"
-            response = requests.get(
-                url,
-                headers={
-                    "Authorization": f"Bearer {license_row.license_data}",
-                    "Content-Type": "application/json",
-                },
-                timeout=30,
-            )
-
+        headers = {
+            "Authorization": f"Bearer {token}",
+            "Content-Type": "application/json",
+        }
+        url = f"{CONTROL_PLANE_API_BASE_URL}/license/{tenant_id}"
+        response = requests.get(url, headers=headers, timeout=10)
         response.raise_for_status()
 
         data = response.json()
-        license_data = data.get("license")
+        if not isinstance(data, dict) or "license" not in data:
+            raise HTTPException(
+                status_code=502, detail="Invalid response from control plane"
+            )
 
+        license_data = data["license"]
         if not license_data:
-            raise HTTPException(status_code=404, detail="No license in response")
+            raise HTTPException(status_code=404, detail="No license found")
 
         # Verify signature before persisting
         payload = verify_license_signature(license_data)
 
-        # Store in DB
-        upsert_license(db_session, license_data)
+        # Verify the fetched license is for this tenant
+        if payload.tenant_id != tenant_id:
+            logger.error(
+                f"License tenant mismatch: expected {tenant_id}, got {payload.tenant_id}"
+            )
+            raise HTTPException(
+                status_code=400,
+                detail="License tenant ID mismatch - control plane returned wrong license",
+            )
 
+        # Persist to DB and update cache atomically
+        upsert_license(db_session, license_data)
         try:
             update_license_cache(payload, source=LicenseSource.AUTO_FETCH)
         except Exception as cache_error:
+            # Log but don't fail - DB is source of truth, cache will refresh on next read
             logger.warning(f"Failed to update license cache: {cache_error}")
 
-        logger.info(
-            f"License claimed: seats={payload.seats}, expires={payload.expires_at.date()}"
-        )
         return LicenseResponse(success=True, license=payload)
 
     except requests.HTTPError as e:
         status_code = e.response.status_code if e.response is not None else 502
-        detail = "Failed to claim license"
-        try:
-            error_data = e.response.json() if e.response is not None else {}
-            detail = error_data.get("detail", detail)
-        except Exception:
-            pass
-        raise HTTPException(status_code=status_code, detail=detail)
+        logger.error(f"Control plane returned error: {status_code}")
+        raise HTTPException(
+            status_code=status_code,
+            detail="Failed to fetch license from control plane",
+        )
     except ValueError as e:
+        logger.error(f"License verification failed: {type(e).__name__}")
         raise HTTPException(status_code=400, detail=str(e))
     except requests.RequestException:
+        logger.exception("Failed to fetch license from control plane")
         raise HTTPException(
-            status_code=502, detail="Failed to connect to license server"
+            status_code=502, detail="Failed to connect to control plane"
         )
 
 
@@ -196,36 +164,33 @@ async def upload_license(
     db_session: Session = Depends(get_session),
 ) -> LicenseUploadResponse:
     """
-    Upload a license file manually (self-hosted only).
-
-    Used for air-gapped deployments where the cloud data plane is not accessible.
-    The license file must be cryptographically signed by Onyx.
+    Upload a license file manually.
+    Used for air-gapped deployments where control plane is not accessible.
     """
-    if MULTI_TENANT:
-        raise HTTPException(
-            status_code=400,
-            detail="License upload is only available for self-hosted deployments",
-        )
-
     try:
         content = await license_file.read()
         license_data = content.decode("utf-8").strip()
     except UnicodeDecodeError:
         raise HTTPException(status_code=400, detail="Invalid license file format")
 
-    # Verify cryptographic signature - this is the only validation needed
-    # The license's tenant_id identifies the customer in control plane, not locally
     try:
         payload = verify_license_signature(license_data)
     except ValueError as e:
         raise HTTPException(status_code=400, detail=str(e))
 
+    tenant_id = get_current_tenant_id()
+    if payload.tenant_id != tenant_id:
+        raise HTTPException(
+            status_code=400,
+            detail=f"License tenant ID mismatch. Expected {tenant_id}, got {payload.tenant_id}",
+        )
+
     # Persist to DB and update cache
     upsert_license(db_session, license_data)
-
     try:
         update_license_cache(payload, source=LicenseSource.MANUAL_UPLOAD)
     except Exception as cache_error:
+        # Log but don't fail - DB is source of truth, cache will refresh on next read
         logger.warning(f"Failed to update license cache: {cache_error}")
 
     return LicenseUploadResponse(
@@ -240,10 +205,8 @@ async def refresh_license_cache_endpoint(
     db_session: Session = Depends(get_session),
 ) -> LicenseStatusResponse:
     """
-    Force refresh the license cache from the local database.
-
+    Force refresh the license cache from the database.
     Useful after manual database changes or to verify license validity.
-    Does NOT fetch from control plane - use /claim for that.
     """
     metadata = refresh_license_cache(db_session)
 
@@ -270,15 +233,9 @@ async def delete_license(
 ) -> dict[str, bool]:
     """
     Delete the current license.
-
-    Admin only - removes license from database and invalidates cache.
+    Admin only - removes license and invalidates cache.
     """
-    if MULTI_TENANT:
-        raise HTTPException(
-            status_code=400,
-            detail="License deletion is only available for self-hosted deployments",
-        )
-
+    # Invalidate cache first - if DB delete fails, stale cache is worse than no cache
     try:
         invalidate_license_cache()
     except Exception as cache_error:

backend/ee/onyx/server/manage/standard_answer.py

@@ -27,7 +27,7 @@ router = APIRouter(prefix="/manage")
 def create_standard_answer(
     standard_answer_creation_request: StandardAnswerCreationRequest,
     db_session: Session = Depends(get_session),
-    _: User = Depends(current_admin_user),
+    _: User | None = Depends(current_admin_user),
 ) -> StandardAnswer:
     standard_answer_model = insert_standard_answer(
         keyword=standard_answer_creation_request.keyword,
@@ -43,7 +43,7 @@ def create_standard_answer(
 @router.get("/admin/standard-answer")
 def list_standard_answers(
     db_session: Session = Depends(get_session),
-    _: User = Depends(current_admin_user),
+    _: User | None = Depends(current_admin_user),
 ) -> list[StandardAnswer]:
     standard_answer_models = fetch_standard_answers(db_session=db_session)
     return [
@@ -57,7 +57,7 @@ def patch_standard_answer(
     standard_answer_id: int,
     standard_answer_creation_request: StandardAnswerCreationRequest,
     db_session: Session = Depends(get_session),
-    _: User = Depends(current_admin_user),
+    _: User | None = Depends(current_admin_user),
 ) -> StandardAnswer:
     existing_standard_answer = fetch_standard_answer(
         standard_answer_id=standard_answer_id,
@@ -83,7 +83,7 @@ def patch_standard_answer(
 def delete_standard_answer(
     standard_answer_id: int,
     db_session: Session = Depends(get_session),
-    _: User = Depends(current_admin_user),
+    _: User | None = Depends(current_admin_user),
 ) -> None:
     return remove_standard_answer(
         standard_answer_id=standard_answer_id,
@@ -95,7 +95,7 @@ def delete_standard_answer(
 def create_standard_answer_category(
     standard_answer_category_creation_request: StandardAnswerCategoryCreationRequest,
     db_session: Session = Depends(get_session),
-    _: User = Depends(current_admin_user),
+    _: User | None = Depends(current_admin_user),
 ) -> StandardAnswerCategory:
     standard_answer_category_model = insert_standard_answer_category(
         category_name=standard_answer_category_creation_request.name,
@@ -107,7 +107,7 @@ def create_standard_answer_category(
 @router.get("/admin/standard-answer/category")
 def list_standard_answer_categories(
     db_session: Session = Depends(get_session),
-    _: User = Depends(current_admin_user),
+    _: User | None = Depends(current_admin_user),
 ) -> list[StandardAnswerCategory]:
     standard_answer_category_models = fetch_standard_answer_categories(
         db_session=db_session
@@ -123,7 +123,7 @@ def patch_standard_answer_category(
     standard_answer_category_id: int,
     standard_answer_category_creation_request: StandardAnswerCategoryCreationRequest,
     db_session: Session = Depends(get_session),
-    _: User = Depends(current_admin_user),
+    _: User | None = Depends(current_admin_user),
 ) -> StandardAnswerCategory:
     existing_standard_answer_category = fetch_standard_answer_category(
         standard_answer_category_id=standard_answer_category_id,

backend/ee/onyx/server/middleware/license_enforcement.py

@@ -1,187 +0,0 @@
-"""Middleware to enforce license status for SELF-HOSTED deployments only.
-
-NOTE: This middleware is NOT used for multi-tenant (cloud) deployments.
-Multi-tenant gating is handled separately by the control plane via the
-/tenants/product-gating endpoint and is_tenant_gated() checks.
-
-IMPORTANT: Mutual Exclusivity with ENTERPRISE_EDITION_ENABLED
-============================================================
-This middleware is controlled by LICENSE_ENFORCEMENT_ENABLED env var.
-It works alongside the legacy ENTERPRISE_EDITION_ENABLED system:
-
-- LICENSE_ENFORCEMENT_ENABLED=false (default):
-  Middleware is disabled. EE features are controlled solely by
-  ENTERPRISE_EDITION_ENABLED. This preserves legacy behavior.
-
-- LICENSE_ENFORCEMENT_ENABLED=true:
-  Middleware actively enforces license status. EE features require
-  a valid license, regardless of ENTERPRISE_EDITION_ENABLED.
-
-Eventually, ENTERPRISE_EDITION_ENABLED will be removed and license
-enforcement will be the only mechanism for gating EE features.
-
-License Enforcement States (when enabled)
-=========================================
-For self-hosted deployments:
-
-1. No license (never subscribed):
-   - Allow community features (basic connectors, search, chat)
-   - Block EE-only features (analytics, user groups, etc.)
-
-2. GATED_ACCESS (fully expired):
-   - Block all routes except billing/auth/license
-   - User must renew subscription to continue
-
-3. Valid license (ACTIVE, GRACE_PERIOD, PAYMENT_REMINDER):
-   - Full access to all EE features
-   - Seat limits enforced
-   - GRACE_PERIOD/PAYMENT_REMINDER are for notifications only, not blocking
-"""
-
-import logging
-from collections.abc import Awaitable
-from collections.abc import Callable
-
-from fastapi import FastAPI
-from fastapi import Request
-from fastapi import Response
-from fastapi.responses import JSONResponse
-from redis.exceptions import RedisError
-from sqlalchemy.exc import SQLAlchemyError
-
-from ee.onyx.configs.app_configs import LICENSE_ENFORCEMENT_ENABLED
-from ee.onyx.configs.license_enforcement_config import EE_ONLY_PATH_PREFIXES
-from ee.onyx.configs.license_enforcement_config import (
-    LICENSE_ENFORCEMENT_ALLOWED_PREFIXES,
-)
-from ee.onyx.db.license import get_cached_license_metadata
-from ee.onyx.db.license import refresh_license_cache
-from onyx.db.engine.sql_engine import get_session_with_current_tenant
-from onyx.server.settings.models import ApplicationStatus
-from shared_configs.contextvars import get_current_tenant_id
-
-
-def _is_path_allowed(path: str) -> bool:
-    """Check if path is in allowlist (prefix match)."""
-    return any(
-        path.startswith(prefix) for prefix in LICENSE_ENFORCEMENT_ALLOWED_PREFIXES
-    )
-
-
-def _is_ee_only_path(path: str) -> bool:
-    """Check if path requires EE license (prefix match)."""
-    return any(path.startswith(prefix) for prefix in EE_ONLY_PATH_PREFIXES)
-
-
-def add_license_enforcement_middleware(
-    app: FastAPI, logger: logging.LoggerAdapter
-) -> None:
-    logger.info("License enforcement middleware registered")
-
-    @app.middleware("http")
-    async def enforce_license(
-        request: Request, call_next: Callable[[Request], Awaitable[Response]]
-    ) -> Response:
-        """Block requests when license is expired/gated."""
-        if not LICENSE_ENFORCEMENT_ENABLED:
-            return await call_next(request)
-
-        path = request.url.path
-        if path.startswith("/api"):
-            path = path[4:]
-
-        if _is_path_allowed(path):
-            return await call_next(request)
-
-        is_gated = False
-        tenant_id = get_current_tenant_id()
-
-        try:
-            metadata = get_cached_license_metadata(tenant_id)
-
-            # If no cached metadata, check database (cache may have been cleared)
-            if not metadata:
-                logger.debug(
-                    "[license_enforcement] No cached license, checking database..."
-                )
-                try:
-                    with get_session_with_current_tenant() as db_session:
-                        metadata = refresh_license_cache(db_session, tenant_id)
-                        if metadata:
-                            logger.info(
-                                "[license_enforcement] Loaded license from database"
-                            )
-                except SQLAlchemyError as db_error:
-                    logger.warning(
-                        f"[license_enforcement] Failed to check database for license: {db_error}"
-                    )
-
-            if metadata:
-                # User HAS a license (current or expired)
-                if metadata.status == ApplicationStatus.GATED_ACCESS:
-                    # License fully expired - gate the user
-                    # Note: GRACE_PERIOD and PAYMENT_REMINDER are for notifications only,
-                    # they don't block access
-                    is_gated = True
-                else:
-                    # License is active - check seat limit
-                    # used_seats in cache is kept accurate via invalidation
-                    # when users are added/removed
-                    if metadata.used_seats > metadata.seats:
-                        logger.info(
-                            f"[license_enforcement] Blocking request: "
-                            f"seat limit exceeded ({metadata.used_seats}/{metadata.seats})"
-                        )
-                        return JSONResponse(
-                            status_code=402,
-                            content={
-                                "detail": {
-                                    "error": "seat_limit_exceeded",
-                                    "message": f"Seat limit exceeded: {metadata.used_seats} of {metadata.seats} seats used.",
-                                    "used_seats": metadata.used_seats,
-                                    "seats": metadata.seats,
-                                }
-                            },
-                        )
-            else:
-                # No license in cache OR database = never subscribed
-                # Allow community features, but block EE-only features
-                if _is_ee_only_path(path):
-                    logger.info(
-                        f"[license_enforcement] Blocking EE-only path (no license): {path}"
-                    )
-                    return JSONResponse(
-                        status_code=402,
-                        content={
-                            "detail": {
-                                "error": "enterprise_license_required",
-                                "message": "This feature requires an Enterprise license. "
-                                "Please upgrade to access this functionality.",
-                            }
-                        },
-                    )
-                logger.debug(
-                    "[license_enforcement] No license, allowing community features"
-                )
-                is_gated = False
-        except RedisError as e:
-            logger.warning(f"Failed to check license metadata: {e}")
-            # Fail open - don't block users due to Redis connectivity issues
-            is_gated = False
-
-        if is_gated:
-            logger.info(
-                f"[license_enforcement] Blocking request (license expired): {path}"
-            )
-
-            return JSONResponse(
-                status_code=402,
-                content={
-                    "detail": {
-                        "error": "license_expired",
-                        "message": "Your subscription has expired. Please update your billing.",
-                    }
-                },
-            )
-
-        return await call_next(request)

backend/ee/onyx/server/query_and_chat/chat_backend.py

@@ -0,0 +1,217 @@
+from fastapi import APIRouter
+from fastapi import Depends
+from fastapi import HTTPException
+from sqlalchemy.orm import Session
+
+from ee.onyx.server.query_and_chat.models import BasicCreateChatMessageRequest
+from ee.onyx.server.query_and_chat.models import (
+    BasicCreateChatMessageWithHistoryRequest,
+)
+from onyx.auth.users import current_user
+from onyx.chat.chat_utils import create_chat_history_chain
+from onyx.chat.models import ChatBasicResponse
+from onyx.chat.process_message import gather_stream
+from onyx.chat.process_message import stream_chat_message_objects
+from onyx.configs.constants import MessageType
+from onyx.context.search.models import OptionalSearchSetting
+from onyx.context.search.models import RetrievalDetails
+from onyx.db.chat import create_chat_session
+from onyx.db.chat import create_new_chat_message
+from onyx.db.chat import get_or_create_root_message
+from onyx.db.engine.sql_engine import get_session
+from onyx.db.models import User
+from onyx.llm.factory import get_llm_for_persona
+from onyx.natural_language_processing.utils import get_tokenizer
+from onyx.server.query_and_chat.models import CreateChatMessageRequest
+from onyx.server.query_and_chat.models import MessageOrigin
+from onyx.utils.logger import setup_logger
+
+logger = setup_logger()
+
+router = APIRouter(prefix="/chat")
+
+
+@router.post("/send-message-simple-api")
+def handle_simplified_chat_message(
+    chat_message_req: BasicCreateChatMessageRequest,
+    user: User | None = Depends(current_user),
+    db_session: Session = Depends(get_session),
+) -> ChatBasicResponse:
+    """This is a Non-Streaming version that only gives back a minimal set of information"""
+    logger.notice(f"Received new simple api chat message: {chat_message_req.message}")
+
+    if not chat_message_req.message:
+        raise HTTPException(status_code=400, detail="Empty chat message is invalid")
+
+    # Handle chat session creation if chat_session_id is not provided
+    if chat_message_req.chat_session_id is None:
+        if chat_message_req.persona_id is None:
+            raise HTTPException(
+                status_code=400,
+                detail="Either chat_session_id or persona_id must be provided",
+            )
+
+        # Create a new chat session with the provided persona_id
+        try:
+            new_chat_session = create_chat_session(
+                db_session=db_session,
+                description="",  # Leave empty for simple API
+                user_id=user.id if user else None,
+                persona_id=chat_message_req.persona_id,
+            )
+            chat_session_id = new_chat_session.id
+        except Exception as e:
+            logger.exception(e)
+            raise HTTPException(status_code=400, detail="Invalid Persona provided.")
+    else:
+        chat_session_id = chat_message_req.chat_session_id
+
+    try:
+        parent_message = create_chat_history_chain(
+            chat_session_id=chat_session_id, db_session=db_session
+        )[-1]
+    except Exception:
+        parent_message = get_or_create_root_message(
+            chat_session_id=chat_session_id, db_session=db_session
+        )
+
+    if (
+        chat_message_req.retrieval_options is None
+        and chat_message_req.search_doc_ids is None
+    ):
+        retrieval_options: RetrievalDetails | None = RetrievalDetails(
+            run_search=OptionalSearchSetting.ALWAYS,
+            real_time=False,
+        )
+    else:
+        retrieval_options = chat_message_req.retrieval_options
+
+    full_chat_msg_info = CreateChatMessageRequest(
+        chat_session_id=chat_session_id,
+        parent_message_id=parent_message.id,
+        message=chat_message_req.message,
+        file_descriptors=[],
+        search_doc_ids=chat_message_req.search_doc_ids,
+        retrieval_options=retrieval_options,
+        # Simple API does not support reranking, hide complexity from user
+        rerank_settings=None,
+        query_override=chat_message_req.query_override,
+        # Currently only applies to search flow not chat
+        chunks_above=0,
+        chunks_below=0,
+        full_doc=chat_message_req.full_doc,
+        structured_response_format=chat_message_req.structured_response_format,
+        origin=MessageOrigin.API,
+    )
+
+    packets = stream_chat_message_objects(
+        new_msg_req=full_chat_msg_info,
+        user=user,
+        db_session=db_session,
+    )
+
+    return gather_stream(packets)
+
+
+@router.post("/send-message-simple-with-history")
+def handle_send_message_simple_with_history(
+    req: BasicCreateChatMessageWithHistoryRequest,
+    user: User | None = Depends(current_user),
+    db_session: Session = Depends(get_session),
+) -> ChatBasicResponse:
+    """This is a Non-Streaming version that only gives back a minimal set of information.
+    takes in chat history maintained by the caller
+    and does query rephrasing similar to answer-with-quote"""
+
+    if len(req.messages) == 0:
+        raise HTTPException(status_code=400, detail="Messages cannot be zero length")
+
+    # This is a sanity check to make sure the chat history is valid
+    # It must start with a user message and alternate beteen user and assistant
+    expected_role = MessageType.USER
+    for msg in req.messages:
+        if not msg.message:
+            raise HTTPException(
+                status_code=400, detail="One or more chat messages were empty"
+            )
+
+        if msg.role != expected_role:
+            raise HTTPException(
+                status_code=400,
+                detail="Message roles must start and end with MessageType.USER and alternate in-between.",
+            )
+        if expected_role == MessageType.USER:
+            expected_role = MessageType.ASSISTANT
+        else:
+            expected_role = MessageType.USER
+
+    query = req.messages[-1].message
+    msg_history = req.messages[:-1]
+
+    logger.notice(f"Received new simple with history chat message: {query}")
+
+    user_id = user.id if user is not None else None
+    chat_session = create_chat_session(
+        db_session=db_session,
+        description="handle_send_message_simple_with_history",
+        user_id=user_id,
+        persona_id=req.persona_id,
+    )
+
+    llm = get_llm_for_persona(persona=chat_session.persona, user=user)
+
+    llm_tokenizer = get_tokenizer(
+        model_name=llm.config.model_name,
+        provider_type=llm.config.model_provider,
+    )
+
+    # Every chat Session begins with an empty root message
+    root_message = get_or_create_root_message(
+        chat_session_id=chat_session.id, db_session=db_session
+    )
+
+    chat_message = root_message
+    for msg in msg_history:
+        chat_message = create_new_chat_message(
+            chat_session_id=chat_session.id,
+            parent_message=chat_message,
+            message=msg.message,
+            token_count=len(llm_tokenizer.encode(msg.message)),
+            message_type=msg.role,
+            db_session=db_session,
+            commit=False,
+        )
+    db_session.commit()
+
+    if req.retrieval_options is None and req.search_doc_ids is None:
+        retrieval_options: RetrievalDetails | None = RetrievalDetails(
+            run_search=OptionalSearchSetting.ALWAYS,
+            real_time=False,
+        )
+    else:
+        retrieval_options = req.retrieval_options
+
+    full_chat_msg_info = CreateChatMessageRequest(
+        chat_session_id=chat_session.id,
+        parent_message_id=chat_message.id,
+        message=query,
+        file_descriptors=[],
+        search_doc_ids=req.search_doc_ids,
+        retrieval_options=retrieval_options,
+        # Simple API does not support reranking, hide complexity from user
+        rerank_settings=None,
+        query_override=None,
+        chunks_above=0,
+        chunks_below=0,
+        full_doc=req.full_doc,
+        structured_response_format=req.structured_response_format,
+        origin=MessageOrigin.API,
+    )
+
+    packets = stream_chat_message_objects(
+        new_msg_req=full_chat_msg_info,
+        user=user,
+        db_session=db_session,
+    )
+
+    return gather_stream(packets)

backend/ee/onyx/server/query_and_chat/models.py

@@ -1,12 +1,18 @@
-from collections.abc import Sequence
-from datetime import datetime
+from collections import OrderedDict
+from typing import Literal
+from uuid import UUID
 
 from pydantic import BaseModel
 from pydantic import Field
+from pydantic import model_validator
 
+from onyx.chat.models import ThreadMessage
+from onyx.configs.constants import DocumentSource
 from onyx.context.search.models import BaseFilters
-from onyx.context.search.models import InferenceSection
-from onyx.context.search.models import SearchDoc
+from onyx.context.search.models import BasicChunkRequest
+from onyx.context.search.models import ChunkContext
+from onyx.context.search.models import InferenceChunk
+from onyx.context.search.models import RetrievalDetails
 from onyx.server.manage.models import StandardAnswer
 
 
@@ -19,89 +25,119 @@ class StandardAnswerResponse(BaseModel):
     standard_answers: list[StandardAnswer] = Field(default_factory=list)
 
 
-class SearchFlowClassificationRequest(BaseModel):
-    user_query: str
+class DocumentSearchRequest(BasicChunkRequest):
+    user_selected_filters: BaseFilters | None = None
 
 
-class SearchFlowClassificationResponse(BaseModel):
-    is_search_flow: bool
+class DocumentSearchResponse(BaseModel):
+    top_documents: list[InferenceChunk]
 
 
-class SendSearchQueryRequest(BaseModel):
-    search_query: str
-    filters: BaseFilters | None = None
-    num_docs_fed_to_llm_selection: int | None = None
-    run_query_expansion: bool = False
-    num_hits: int = 50
+class BasicCreateChatMessageRequest(ChunkContext):
+    """If a chat_session_id is not provided, a persona_id must be provided to automatically create a new chat session
+    Note, for simplicity this option only allows for a single linear chain of messages
+    """
 
-    include_content: bool = False
-    stream: bool = False
+    chat_session_id: UUID | None = None
+    # Optional persona_id to create a new chat session if chat_session_id is not provided
+    persona_id: int | None = None
+    # New message contents
+    message: str
+    # Defaults to using retrieval with no additional filters
+    retrieval_options: RetrievalDetails | None = None
+    # Allows the caller to specify the exact search query they want to use
+    # will disable Query Rewording if specified
+    query_override: str | None = None
+    # If search_doc_ids provided, then retrieval options are unused
+    search_doc_ids: list[int] | None = None
+    # only works if using an OpenAI model. See the following for more details:
+    # https://platform.openai.com/docs/guides/structured-outputs/introduction
+    structured_response_format: dict | None = None
+
+    @model_validator(mode="after")
+    def validate_chat_session_or_persona(self) -> "BasicCreateChatMessageRequest":
+        if self.chat_session_id is None and self.persona_id is None:
+            raise ValueError("Either chat_session_id or persona_id must be provided")
+        return self
 
 
-class SearchDocWithContent(SearchDoc):
-    # Allows None because this is determined by a flag but the object used in code
-    # of the search path uses this type
-    content: str | None
+class BasicCreateChatMessageWithHistoryRequest(ChunkContext):
+    # Last element is the new query. All previous elements are historical context
+    messages: list[ThreadMessage]
+    persona_id: int
+    retrieval_options: RetrievalDetails | None = None
+    query_override: str | None = None
+    skip_rerank: bool | None = None
+    # If search_doc_ids provided, then retrieval options are unused
+    search_doc_ids: list[int] | None = None
+    # only works if using an OpenAI model. See the following for more details:
+    # https://platform.openai.com/docs/guides/structured-outputs/introduction
+    structured_response_format: dict | None = None
 
-    @classmethod
-    def from_inference_sections(
-        cls,
-        sections: Sequence[InferenceSection],
-        include_content: bool = False,
-        is_internet: bool = False,
-    ) -> list["SearchDocWithContent"]:
-        """Convert InferenceSections to SearchDocWithContent objects.
 
-        Args:
-            sections: Sequence of InferenceSection objects
-            include_content: If True, populate content field with combined_content
-            is_internet: Whether these are internet search results
+class SimpleDoc(BaseModel):
+    id: str
+    semantic_identifier: str
+    link: str | None
+    blurb: str
+    match_highlights: list[str]
+    source_type: DocumentSource
+    metadata: dict | None
 
-        Returns:
-            List of SearchDocWithContent with optional content
+
+class AgentSubQuestion(BaseModel):
+    sub_question: str
+    document_ids: list[str]
+
+
+class AgentAnswer(BaseModel):
+    answer: str
+    answer_type: Literal["agent_sub_answer", "agent_level_answer"]
+
+
+class AgentSubQuery(BaseModel):
+    sub_query: str
+    query_id: int
+
+    @staticmethod
+    def make_dict_by_level_and_question_index(
+        original_dict: dict[tuple[int, int, int], "AgentSubQuery"],
+    ) -> dict[int, dict[int, list["AgentSubQuery"]]]:
+        """Takes a dict of tuple(level, question num, query_id) to sub queries.
+
+        returns a dict of level to dict[question num to list of query_id's]
+        Ordering is asc for readability.
         """
-        if not sections:
-            return []
+        # In this function, when we sort int | None, we deliberately push None to the end
 
-        return [
-            cls(
-                document_id=(chunk := section.center_chunk).document_id,
-                chunk_ind=chunk.chunk_id,
-                semantic_identifier=chunk.semantic_identifier or "Unknown",
-                link=chunk.source_links[0] if chunk.source_links else None,
-                blurb=chunk.blurb,
-                source_type=chunk.source_type,
-                boost=chunk.boost,
-                hidden=chunk.hidden,
-                metadata=chunk.metadata,
-                score=chunk.score,
-                match_highlights=chunk.match_highlights,
-                updated_at=chunk.updated_at,
-                primary_owners=chunk.primary_owners,
-                secondary_owners=chunk.secondary_owners,
-                is_internet=is_internet,
-                content=section.combined_content if include_content else None,
+        # map entries to the level_question_dict
+        level_question_dict: dict[int, dict[int, list["AgentSubQuery"]]] = {}
+        for k1, obj in original_dict.items():
+            level = k1[0]
+            question = k1[1]
+
+            if level not in level_question_dict:
+                level_question_dict[level] = {}
+
+            if question not in level_question_dict[level]:
+                level_question_dict[level][question] = []
+
+            level_question_dict[level][question].append(obj)
+
+        # sort each query_id list and question_index
+        for key1, obj1 in level_question_dict.items():
+            for key2, value2 in obj1.items():
+                # sort the query_id list of each question_index
+                level_question_dict[key1][key2] = sorted(
+                    value2, key=lambda o: o.query_id
+                )
+            # sort the question_index dict of level
+            level_question_dict[key1] = OrderedDict(
+                sorted(level_question_dict[key1].items(), key=lambda x: (x is None, x))
             )
-            for section in sections
-        ]
 
-
-class SearchFullResponse(BaseModel):
-    all_executed_queries: list[str]
-    search_docs: list[SearchDocWithContent]
-    # Reasoning tokens output by the LLM for the document selection
-    doc_selection_reasoning: str | None = None
-    # This a list of document ids that are in the search_docs list
-    llm_selected_doc_ids: list[str] | None = None
-    # Error message if the search failed partway through
-    error: str | None = None
-
-
-class SearchQueryResponse(BaseModel):
-    query: str
-    query_expansions: list[str] | None
-    created_at: datetime
-
-
-class SearchHistoryResponse(BaseModel):
-    search_queries: list[SearchQueryResponse]
+        # sort the top dict of levels
+        sorted_dict = OrderedDict(
+            sorted(level_question_dict.items(), key=lambda x: (x is None, x))
+        )
+        return sorted_dict

backend/ee/onyx/server/query_and_chat/query_backend.py

@@ -22,7 +22,7 @@ basic_router = APIRouter(prefix="/query")
 def get_standard_answer(
     request: StandardAnswerRequest,
     db_session: Session = Depends(get_session),
-    _: User = Depends(current_user),
+    _: User | None = Depends(current_user),
 ) -> StandardAnswerResponse:
     try:
         standard_answers = oneoff_standard_answers(